Automated evidence gathering
Evidence gathering and analysis from networked machines can be automated and made policy-based. In one embodiment, the present invention includes, a networked machine receiving an instruction from a server to execute a pre-recorded action sequence designed to capture evidence data. The machine can annotate the captured evidence data with meta-data, and send the annotated evidence data to the server. The server can then perform analysis on the collected evidence data and present the evidence data and the analysis to an administrator.
1. A method performed by a compliance management system comprising:
instructing a plurality of machines to gather evidence data by selectively capturing screenshots of target views based on areas of interest and by annotating the gathered evidence data with meta-data;
receiving the annotated evidence data from the plurality of machines;
storing the received evidence data; and
determining a baseline evidence data by counting the numbers of identical screenshots of the target views received from the plurality of the machines.
2. The method of claim 1 , wherein instructing the plurality of machines comprises sending to each of the plurality of machines an action sequence to execute, the action sequence comprising a pre-recorded sequence of keystrokes, mouse-clicks, and screenshot captures.
3. The method of claim 2 , wherein the instructing of the plurality of machines and the storing of the received evidence data is performed according to an evidence policy.
4. The method of claim 3 , wherein the evidence policy comprises the action sequence and an indication of a location to store the received evidence data.
5. The method of claim 1 , further comprising removing duplicate screenshots from the evidence data received from the plurality of machines.
6. The method of claim 5 , further comprising retaining meta-data associated with removed duplicate screenshots.
7. A compliance management system comprising:
a network interface to send an instruction to a plurality of machines to gather evidence data by capturing screenshots of target views based on areas of interest and annotating the gathered evidence data with meta-data, and to receive the annotated evidence data from the plurality of machines;
a data store to store the received evidence data; and a processor to determine a location to store the received evidence data based on an evidence policy associated with the sending of the instruction, wherein the processor determines a baseline screenshot by counting the number of identical screenshots received from said machines and generates an alert by comparing the screenshots captured in the received evidence data with said baseline screenshot.
8. The compliance management system of claim 7 , wherein the instruction comprises a pre-recorded action sequence of keystrokes, mouse-clicks, and screenshot captures.
9. The compliance management system of claim 7 , wherein the processor removes duplicate screenshots from the evidence data received from the plurality of machines.
10. The compliance management system of claim 7 , further comprising a user interface, said user interface comprising:
a policy editor to create and edit an evidence policy used to collect evidence data from a remote machine, the policy editor comprising graphic controls to record of an action sequence of keystrokes, mouse-clicks, and screenshots.
11. The compliance management system of claim 10 , wherein the graphic controls include a start action sequence button operable to begin the recording of the action sequence and an end action sequence button operable to finish the recording of the action sequence.
12. The compliance management system of claim 11 , wherein the start action sequence button and end action sequence button comprise the same button.