Retention and accessibility of data characterizing events on an endpoint computer

A non-transitory computer readable medium storing instructions that, when executed by one or more programmable processors, cause the one or more programmable processors to perform operations comprising:

• harvesting, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
• adding the data to a local data store maintained on the endpoint computer system;
• and
• generating a query response in response to a query, the generating comprising identifying and retrieving responsive data from the local data store, the responsive data being related to an artifact on the endpoint computer system and/or to an event of the plurality of events.

A computer-implemented method comprising:

• harvesting, by an endpoint computer system, data relating to a plurality of events occurring within an operating environment of the endpoint computer system, the harvesting comprising receiving and/or inferring the data using one or more sensors executing on the endpoint computer system;
• adding the data to a local data store maintained on the endpoint computer system;
• and
• generating a query response in response to a query, the generating comprising identifying and retrieving responsive data from the local data store, the responsive data being related to an artifact on the endpoint computer system and/or to an event of the plurality of events.