Systems and methods for providing network security monitoring

A method for detecting malicious lateral activity within a computer network, comprising:

• detecting, by a security monitoring server device, when a client device has connected to the computer network;
• deploying, by the security monitoring server device, an agent to the client device in response to the client device connecting to the computer network;
• subscribing, by the agent, to a plurality of privileged authentication events on the client device, wherein a privileged authentication event indicates an elevated privileged action taken by a user, and wherein the plurality of privileged authentication events include at least share mounting events and execution of administrative commands;
• detecting, by the agent, one of the subscribed privileged authentication events, wherein the detected privileged authentication event comprises event data;
• providing, by the agent, an alert to a security monitoring server device in response to the detection of the one of the subscribed privileged authentication events;
• and
• initiating, by the agent, live collection of network metadata, distinct from the event data, on the client device related to the detected event upon detecting the one of the subscribed privileged authentication events.

A non-transitory computer-readable storage device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:

• detecting, by a security monitoring server device, when a client device has connected to a computer network;
• deploying, by the security monitoring server device, an agent to the client device in response to the client device connecting to the computer network;
• subscribing, by the agent, to a plurality of privileged authentication events on the client device, wherein a privileged authentication event indicates an elevated privileged action taken by a user, and wherein the plurality of privileged authentication events include at least share mounting events and execution of administrative commands;
• detecting, by the agent, one of the subscribed privileged authentication events, wherein the detected privileged authentication event comprises event data;
• providing, by the agent, an alert to a security monitoring server device in response to the detection of the one of the subscribed privileged authentication events;
• and
• initiating, by the agent, live collection of network metadata, distinct from the event data, on the client device related to the detected event upon detecting the one of the subscribed privileged authentication events.