Endpoint with remotely programmable data recorder

A method for modifying security functions of an endpoint in response to security events, the method comprising:

• storing event data for an enterprise network in a data lake wherein:
• the event data includes data from a data recorder on an endpoint associated with the enterprise network, the data recorder is configured to locally store an event stream indicating events on the endpoint including a plurality of types of changes to a plurality of computing objects on the endpoint, the data recorder is configured to apply a filter to locally process the event stream into a filtered event stream including a subset of the plurality of types of changes to the plurality of computing objects, and the endpoint transmits the filtered event stream to the data lake for storage;
• detecting a security event at a threat management facility based on the event data in the data lake, the security event indicative of a potential compromise of the endpoint;
• presenting the security event for human review in a user interface of the threat management facility;
• receiving a modification of operation of the data recorder of the endpoint in the user interface of the threat management facility;
• transmitting the modification of operation of the data recorder from the threat management facility to a local security agent of the endpoint to adjust filtering of the event stream by the data recorder to modify the subset of the plurality of types of changes included in the filtered event stream;
• and
• transmitting a query from the threat management facility to retrieve data stored in the data recorder over a time window before the query and excluded from an adjusted filtered event stream.

A system comprising:

• a data lake configured to store event data for an enterprise network, wherein:
• the event data includes data from a data recorder on an endpoint associated with the enterprise network, the data recorder is configured to locally store an event stream indicating events on the endpoint including a plurality of types of changes to a plurality of computing objects on the endpoint, the data recorder is configured to apply a filter to locally process the event stream into a filtered event stream including a subset of the plurality of types of changes to the plurality of computing objects, and the endpoint transmits the filtered event stream to the data lake for storage;
• and
• a threat management facility configured by non-transitory computer executable code to perform steps of:
• detecting a security event based on the event data in the data lake, the security event indicative of a potential compromise of the endpoint,
• presenting the security event for review in a user interface of the threat management facility,
• receiving a modification of operation of the data recorder of the endpoint comprising a filter adjustment in the user interface of the threat management facility,
• transmitting the filter adjustment from the threat management facility to a local security agent of the endpoint to adjust filtering of the event stream by the data recorder to modify the subset of the plurality of types of changes included in the filtered event stream, and
• transmitting a query from the threat management facility to retrieve data stored in the data recorder over a time window before the query and excluded from an adjusted filtered event stream.