Distributed digital security system

A client device, comprising:

• one or more processors;
• and
• memory storing computer-executable instructions associated with a security agent that, when executed by the one or more processors of the client device, cause the client device to execute an event detector of the security agent, a bounding manager of the security agent, and a communication component of the security agent, wherein:
• the event detector is configured to:
• detect an occurrence of an event locally on the client device;
• and
• generate an event data instance associated with the occurrence of the event;
• the bounding manager comprises a plurality of selectors, wherein:
• different selectors, of the plurality of selectors, are respectively configured to apply different bounding rules associated with different reporting criteria,
• the different selectors are configured to generate respective independent reporting recommendations about whether or not to send event data instances, corresponding to the different reporting criteria, from the security agent on the client device to a security network that is remote from the client device,
• at least one selector, of the plurality of selectors, that is associated with reporting criteria corresponding to one or more attributes of the event data instance, generates at least one reporting recommendation about whether or not the event data instance should be sent by the security agent to the security network, and
• the bounding manager is configured to, based on the at least one reporting recommendation, generate a determination of whether or not to send the event data instance from the security agent to the security network;
• and
• the communication component is configured to send the event data instance to the security network in response to the determination, generated by the bounding manager, indicating that the security agent is to send the event data instance to the security network.

One or more non-transitory computer-readable media storing computer-executable instructions for a bounding manager of a security agent executing on a client device that, when executed by one or more processors of the client device, cause the bounding manager to perform operations comprising:

• receiving an event data instance associated with an occurrence of an event locally on the client device, wherein:
• the bounding manager comprises a plurality of selectors,
• different selectors, of the plurality of selectors, are respectively configured to apply
• different bounding rules associated with different reporting criteria, and the different selectors are configured to generate respective independent reporting recommendations about whether or not to send event data instances, corresponding to the different reporting criteria, from the security agent on the client device to a security network that is remote from the client device;
• determining that one or more attributes of the event data instance corresponds with reporting criteria of at least one selector of the plurality of selectors;
• generating, using the at least one selector associated with the one or more attributes of the event data instance, at least one reporting recommendation about whether or not the event data instance should be sent by the security agent to the security network;
• and
• determining, based on the at least one reporting recommendation generated by the at least one selector, whether or not to send the event data instance from the security agent to the security network.