Agent functionality extensions using surveyors

A method comprising:

• receiving, by an agent executing on an endpoint computing device from a cloud-based monitoring platform, a surveyor package;
• unpacking, by the agent, the surveyor package;
• and
• executing an executable encapsulated in the surveyor package to address a security event;
• wherein:
• the cloud-based monitoring platform generates the surveyor package responsive to a request to deploy a surveyor to an agent executing on the endpoint computing device;
• the request comprises information characterizing a security event which identifies a plurality of files encrypted as part of a ransomware attack and corresponding key material used during the ransomware attack when encrypting each of the plurality of files, wherein a first key material was used to encrypt a first subset of the identified plurality of files and a second key material different from the first key material was used to encrypt a second subset of the identified plurality of files;
• and
• the executable comprises decryptor logic to decrypt at least a portion of the plurality of files.

A system comprising:

• at least one processor;
• and
• memory storing instructions which, when executed by the at least one processor, result in operations comprising:
• sending a request to deploy a surveyor to an agent executing on an endpoint computing device, the request identifying a security event and including a command to execute a surveyor and content files for the surveyor to execute, a first of the content files being a list of files to decrypt and a second of the content files comprising key materials for the list of files to decrypt;
• downloading, by the agent in response to the request received by the cloud-based monitoring system, a surveyor package from a download repository comprising an executable for updating the agent to address the security event and metadata characterizing a surveyor to be updated using the surveyor package, the surveyor package comprising decryptor logic to decrypt the files in the list of files to decrypt;
• unpacking, by the agent, the surveyor package;
• and
• executing, by the agent, the executable to initiate one or more remediation actions to address the security event.