Patent ID: 8561134

Claim:
A computer-implemented method comprising: maintaining, by a remote server, a policy database having stored therein a plurality of policies each of which defines at least one parameter condition violation of which is potentially indicative of unauthorized activity or manipulation of a particular host asset of a plurality of monitored host assets; receiving, by a remote server, via a network coupling the plurality of monitored host assets in communication with the remote server, a value of a parameter of a host asset of the plurality of monitored host assets, wherein the parameter value is one of a plurality of parameter values that collectively characterize an operational state of the host asset at a particular point in time; determining whether a policy of the plurality of policies is violated based on the parameter value by: retrieving, by the remote server from the policy database, one or more policies of the plurality of policies; and evaluating, by the remote server, the one or more policies with reference to the parameter value; and when an affirmative determination regarding violation of the policy has been made: retrieving, by the remote server from a remediation database associated with the remote server, at least one remediation for the host asset based on the policy; and deploying, by the remote server, the at least one retrieved remediation to the host asset.