A computer storage medium storing computer-useable instructions that, when used by at least one processor of a first computing device of a plurality of computing devices in a network, cause the at least one processor to perform operations comprising: generating, by the first computing device, a connectivity configuration and a neighborhood map, the generating based on at least one electronic message received from at least a second computing device of the plurality of computing devices, the at least one electronic message being responsive to at least one broadcast to the network from the first computing device, and an attempt by the first computing device to directly access a remote server device outside the network; obtaining, by the first computing device, a behavioral rule associated with a process of the second computing device, and a log associated with the process; based on the behavioral rule and the log, detecting, by the first computing device, a suspect event associated with the process; selecting, by the first computing device, the second computing device as a target device based on the generated connectivity configuration and the generated neighborhood map, the target device being selected from a group consisting of the remote server device and the plurality of computing devices; generating, by the first computing device, an event dataset associated with the detected suspect event; and communicating, by the first computing device, the generated event dataset to the selected target device. generating, by the first computing device, a connectivity configuration and a neighborhood map, the generating based on at least one electronic message received from at least a second computing device of the plurality of computing devices, the at least one electronic message being responsive to at least one broadcast to the network from the first computing device, and an attempt by the first computing device to directly access a remote server device outside the network; at least one electronic message received from at least a second computing device of the plurality of computing devices, the at least one electronic message being responsive to at least one broadcast to the network from the first computing device, and an attempt by the first computing device to directly access a remote server device outside the network; obtaining, by the first computing device, a behavioral rule associated with a process of the second computing device, and a log associated with the process; a behavioral rule associated with a process of the second computing device, and a log associated with the process; based on the behavioral rule and the log, detecting, by the first computing device, a suspect event associated with the process; selecting, by the first computing device, the second computing device as a target device based on the generated connectivity configuration and the generated neighborhood map, the target device being selected from a group consisting of the remote server device and the plurality of computing devices; generating, by the first computing device, an event dataset associated with the detected suspect event; and communicating, by the first computing device, the generated event dataset to the selected target device.