Patent ID: 11916945
Assignee: CROWDSTRIKE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 15:
16. A computer-implemented method for policy management, comprising:
identifying, by one or more processors, and from among a plurality of machines connected to a network, an originating machine associated with a suspect network activity;
selecting, by the one or more processors, and from among a plurality of pre-existing deployable forensics software agents stored at a policy management unit, the plurality of pre-existing deployable forensics software agents being associated with different types of suspect network activities, a particular forensics software agent configured to collect computer forensics data associated with a type of the suspect network activity;
deploying, by the one or more processors, and by transmitting deployment data to the originating machine via the network, the selected particular forensics software agent to collect the computer forensics data on the originating machine;
receiving, by the one or more processors, the computer forensics data from the deployed particular forensics software agent; and
determining, by the one or more processors, a response action based on the received computer forensics data.