Data structure for policy-based remediation selection

A method of selecting a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

• providing a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between
• at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and
• at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device;
• and
• indexing into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.

A machine-readable medium comprising instructions, execution of which by a machine selects a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

• a first code segment to provide a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between
• at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and
• at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device;
• and
• a second code segment to index into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.

An apparatus for selecting a remediation that is appropriate to a technology present on a machine to be remediated, the method comprising:

• a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between
• at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and
• at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition satisfaction of which is potentially indicative of unauthorized activity or manipulation of the device;
• and
• means for indexing into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.