A system comprising: a memory; and at least one processor to: continually analyze at least one of metrics, events, and conditions in a computer network; under normal operating conditions in the computer network, obtain a first level of data from at least one hardware device in the computer network; detect that one of a condition and an event has occurred in the computer network; automatically transmit an instruction to modify the first level of data obtained from the at least one hardware device to a second level of data more robust than the first level of data when one of the condition and the event has occurred, the second level of data collected from the at least one hardware device at a higher frequency than the first level of data and a higher fidelity than the first level of data; collect the second level of data from the at least one hardware device for a data custody policy determined period of time; store the second level of data obtained from the at least one hardware device; and detect that the one of the condition and the event has ceased and automatically transmit an instruction to revert the second level of data obtained from the at least one hardware device to the first level of data obtained from the at least one hardware device. a memory; and at least one processor to: continually analyze at least one of metrics, events, and conditions in a computer network; under normal operating conditions in the computer network, obtain a first level of data from at least one hardware device in the computer network; detect that one of a condition and an event has occurred in the computer network; automatically transmit an instruction to modify the first level of data obtained from the at least one hardware device to a second level of data more robust than the first level of data when one of the condition and the event has occurred, the second level of data collected from the at least one hardware device at a higher frequency than the first level of data and a higher fidelity than the first level of data; collect the second level of data from the at least one hardware device for a data custody policy determined period of time; store the second level of data obtained from the at least one hardware device; and detect that the one of the condition and the event has ceased and automatically transmit an instruction to revert the second level of data obtained from the at least one hardware device to the first level of data obtained from the at least one hardware device. continually analyze at least one of metrics, events, and conditions in a computer network; under normal operating conditions in the computer network, obtain a first level of data from at least one hardware device in the computer network; detect that one of a condition and an event has occurred in the computer network; automatically transmit an instruction to modify the first level of data obtained from the at least one hardware device to a second level of data more robust than the first level of data when one of the condition and the event has occurred, the second level of data collected from the at least one hardware device at a higher frequency than the first level of data and a higher fidelity than the first level of data; collect the second level of data from the at least one hardware device for a data custody policy determined period of time; store the second level of data obtained from the at least one hardware device; and detect that the one of the condition and the event has ceased and automatically transmit an instruction to revert the second level of data obtained from the at least one hardware device to the first level of data obtained from the at least one hardware device.