Data structure for policy-based remediation selection

1. A method of selecting a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

providing a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device; and

indexing into the memory using a given POL ID value to determine values of the at-least-one R_ID corresponding thereto.

2. The method of claim 1 , wherein the machine-actionable memory further includes:

one or more parameter fields, the contents of which denote present and one or more previous values of one or more parameters associated with the at-least-one policy.

3. The method of claim 1 , wherein the machine-actionable memory further includes:

at least one ACT_ID field, the contents of which denotes an ID of an action (ACT_ID).

4. The method of claim 1 , wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation; and

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation.

5. The method of claim 1 , wherein the machine-actionable memory further includes:

at least one CE_ID field, the contents of which denotes an ID of an asset (CE_ID) to which the remediation is to be applied.

6. The method of claim 5 , wherein:

excursion of one or more parameter values outside of the boundaries of the at least one policy denoted by the at least one POL_ID field may be cause for invoking the remediation;

execution of the at least one action denoted by the contents of the at least one ACT_ID field at least in part implements the remediation; and

implementation of the remediation upon the at least one asset denoted by the contents of the at least one CE_ID field mitigates against a future excursion of the one or more parameter values outside the boundaries of the at least one policy.

7. The method of claim 5 , wherein the machine-actionable memory for at least one of the one or more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

two or more SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively;

two or more CE_ID fields, the contents of which denote two or more CE_ID fields; and

at least one of the following,

(A) at least two P-55 links between the two or more POL_ID fields, respectively, and the two or more subsets,

(B) at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

(C) at least two R-SS links between the at-least-one R_ID field and the two or more subsets, respectively, and

(D) at least two R-AS links between the at-least-one R_ID field and the two or more CE_ID fields, respectively.

8. The method of claim 1 , wherein the machine-actionable memory for at least one of the one-or-more machine-actionable records includes:

two or more POL_ID fields, the contents of which denote two or more POL_IDs, respectively;

a plurality of ACT_ID fields, the contents of which denote a plurality of ACT_IDs, respectively;

at least two SS links relating one or more among the plurality of ACT_ID fields as a subset (SS) thereof, respectively; and

at least one of the following,

(A) at least two P-SS links between the two or more POL_ID fields, respectively, and the two or more subsets,

(B) at least two R-P links between the at-least-one R_ID field and the two or more POL_ID fields, respectively,

(C) at least two R-55 links between the at-least-one R_ID field and the two or more subsets, respectively.

9. A machine configured to implement the method of claim 1 .

10. A machine-readable medium comprising instructions, execution of which by a machine selects a remediation that is appropriate to a policy for a device that includes a processor, the method comprising:

a first code segment to provide a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and

at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device; and

a second code segment to index into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.

11. An apparatus for selecting a remediation that is appropriate to a technology present on a machine to be remediated, the method comprising:

a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between

at least one R_ID field, the contents of which denote an identification (ID) of a remediation (R_ID), and

at least one POL_ID field, the contents of which denotes an ID of a policy (POL_ID), the policy defining a condition violation of which is potentially indicative of unauthorized activity or manipulation of the device; and

means for indexing into the memory using a given POL_ID value to determine values of the at-least-one R_ID corresponding thereto.