Patent ID: 11916945
Assignee: CROWDSTRIKE, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 10:
11. A system for policy management comprising:
a network device configured to:
monitor network traffic between a plurality of machines and a network;
detect, based on a set of network activity rules, suspect network activity associated with the network traffic; and
identify an originating machine, of the plurality of machines, that sent a network communication associated with the suspect network activity; and
a policy management unit, associated with the network device, configured to:
receive a notification, from the network device, indicating the suspect network activity and identifying the originating machine;
store a plurality of pre-existing deployable forensics software agents;
select, from among the stored plurality of pre-existing deployable forensics software agents associated with different types of suspect network activities, a particular forensics software agent configured to collect computer forensics data associated with a type of the suspect network activity;
deploy, by transmitting deployment data to the originating machine via the network, the selected particular forensics software agent to collect the computer forensics data on the originating machine;
receive the computer forensics data from the particular deployed forensics software agent; and
determine a response action based on the received computer forensics data.