Adaptive data collection for root-cause analysis and intrusion detection

An enterprise security management product configured to perform adaptive data collection in an endpoint of an enterprise security environment, the product comprising:

• an endpoint coupled to a security assessment channel, the endpoint including a server, the security assessment channel configured to receive a security assessment that describes an object in the environment, the security assessment being a tentative assignment of security meaning to information relating to the object and further comprising a plurality of fields, at least one of the fields is a fidelity field that is arranged to express a degree of confidence an endpoint has in the security assessment, the security assessment being arranged to provide contextual meaning to the object and being defined with an estimated time interval over which the security assessment is valid;
• the endpoint configured to switch from a first data collection mode to a second data collection mode responsively to the received security assessment, the second data collection mode collecting a larger subset of available data in the environment than is collected while in the first data collection mode;
• the endpoint configured to analyze the collected larger subset of available data;
• and
• the endpoint configured to roll-back to the first data collection mode upon expiration of the estimated time interval.

An endpoint, comprising:

• a computer coupled to a security assessment channel, the security assessment channel configured to receive a security assessment at a server that describes an object in the environment, the security assessment being a tentative assignment of security meaning to information relating to the object and further comprising a plurality of fields, at least one of the fields is a fidelity field that is arranged to express a degree of confidence an endpoint has in the security assessment, the security assessment being arranged to provide contextual meaning to the object and being defined with an estimated time interval over which the security assessment is valid;
• the computer configured to switch from a first data collection mode to a second data collection mode responsively to the received security assessment, the second data collection mode collecting a larger subset of available data in the environment than is collected while in the first data collection mode;
• the computer configured to analyze the collected larger subset of available data;
• and
• the computer configured to roll-back to the first data collection mode upon expiration of the estimated time interval.