User device agent event detection and recovery

A method, comprising:

• subscribing, by an endpoint detection and response (EDR) module at a user device, to one or more events at the user device;
• receiving, at the EDR module at the user device, a notification of an event at the user device;
• upon determining, by the EDR module, that the event is associated with a file stored at the user device, instantiating, by an event tracer module, an event tracer tree that is associated with the file;
• generating, by the event tracer module, an event tracer tree root node that is associated with the file;
• receiving, by the event tracer module, new event data associated with the file, the new event data being associated with a file system event at the user device;
• routing, by the event tracer module, the new event data to an event handler based on a determined event type of the new event data, wherein the determined event type indicates that a change has been made to the file;
• generating, by the event tracer module, a new node in the event tracer tree based on the new event data;
• resolving, by the event tracer module, a file system discrepancy at the user device using the event tracer tree, the file system discrepancy having been caused by the file system event;
• generating, by the EDR module, a file hash value for the file using the event tracer tree;
• and
• upon determining, by the EDR module, that the file hash value satisfies a security rule received from a remote management platform, quarantining the file.