Probing and responding to computer network security breaches

A method of probing and responding to a security breach in a computer network, the method comprising:

• defining, by a device, first rules and second rules;
• defining a model to output a probability that a security breach has occurred based on an input and to generate commands;
• collecting data at a plurality of first nodes according to the first rules, said first nodes forming a first computer network;
• storing the collected data at one or more of the plurality of first nodes or at a dedicated storage location on the first computer network;
• selecting a first portion of the collected data according to the first rules, wherein the first portion is less than the collected data;
• sending the selected first portion from the first nodes to a second node, said second node forming part of a second computer network,
• wherein the sending the selected first portion is based on an adjustment of a verbosity level of at least one program of the device minimizing and prioritizing data volume of the first portion,
• wherein the adjustment of the verbosity level is based on a determination of whether the at least one program is not known and trusted, and
• wherein the verbosity level is changed from a default setting at a start of the at least one program based on the at least one program being determined to not be known and trusted;
• inputting the selected first portion into the model to obtain an output probability that a security breach has occurred;
• and
• if the output probability meets predetermined criteria:
• (a) determining that signs of a security breach have been detected,
• (b) generating a first command with the model to cause a second portion of the collected data to be selected and sent from the first nodes to the second node according to the second rules,
• wherein the second rules are dynamically created in response to the detected security breach to at least select and send a volume of the collected data based on a set of at least one of default selecting or sending policies associated with the verbosity level started by the device that is changed during execution of the sending, and
• wherein the verbosity level is changed dynamically to at least one of increase, decrease, or balance the second portion of the collected data for the selecting or sending policies at a next available predetermined time interval based on predetermined criteria comprising threshold probability values indicative of a security breach and a trust level of an application from which the collected data is received;
• and
• (c) generating a second command with the model to cause a change in settings at one or more of the first nodes.