Patent ID: 8331904

Claim:
Apparatus comprising: a processor configured to perform at least the following: monitor said apparatus for security attacks and to store collected security related data comprising a full detail level logging functionality of events; select and send at least some of the collected security related data from the full detail level logging functionality of events to a network security node, wherein the amount of the collected security related data selected and sent to said security node over the network is dependent on a security level of said apparatus, where said processor is operable in a pull mode of operation in response to a security alarm received from the network security node so as to send over the network, upon request of the network security node, the collected security related data at a requested level of detail, and where in response to a reception of a notification of an increase in security level from an initial security level at a certain point in time, said processor is further configured to operate in a backtracking mode so as to send over the network collected security related data at an increased level of detail both for times subsequent to the point in time and for times preceding the point in time, the increased level of detail relative to a level of detail for the initial security level.