Patent ID: 11924230
Assignee: LOOKOUT, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G  Y | IPC G  H

Claim 8:
9. A method comprising:
at a server, monitoring a plurality of devices for observation data according to a first data monitoring policy, the monitored observation data including information associated with at least one of: device configuration, device state, or device behavior;
at the server, establishing a normal pattern of activity occurring on the plurality of devices based on the monitored observation data, the normal pattern of activity being associated with at least one of: the device configuration, the device state, or the device behavior, of the plurality of devices;
at the server, creating a second data monitoring policy using the determined normal pattern of activity occurring on the plurality of devices, the second data monitoring policy being different from the first data monitoring policy;
at the server, according to the second data monitoring policy, monitoring a first device of the plurality of devices for first device data;
at the server, comparing the normal pattern of activity occurring on the plurality of devices with a first pattern of activity occurring on the first device, the first pattern of activity being determined by the monitored first device data;
at the server, determining that the first pattern of activity associated with the first device of the plurality of devices is beyond a threshold deviation from the normal pattern of activity; and
upon the determination, modifying the second data monitoring policy for monitoring of the first device by the server.