Adaptive security filtering on a client device
Adaptive security filtering on a client device. A method may include applying a data filter to a client device to obtain a first set of data associated with the client device, determining a risk level of a datum of the first set of data, determining a resource level associated with obtaining the first set of data, adjusting the data filter to an adjusted filter based on the determined risk level of the datum and the determined resource level, and applying the adjusted filter to the client device.
1. A computer-implemented method for adaptive security filtering on a plurality of client devices within an enterprise, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:
applying a pre-configured data filter to a first client device within the enterprise to obtain a first set of data associated with the first client device;
applying the pre-configured data filter to a second client device within the enterprise to obtain a second set of data associated with the second client device;
adjusting the pre-configured data filter applied to the first client device to a first adjusted data filter that increases the amount of data obtained from the first client device based on a suspicious event detected in the first set of data;
applying the first adjusted data filter to the first client device;
adjusting the pre-configured data filter applied to the second client device to a second adjusted data filter that decreases the amount of data obtained from the second client device based on an increase in resource consumption, the increase in resource consumption being caused at least in part by the increased amount of data obtained from the first client device; and
applying the second adjusted data filter to the second client device.
2. The method of claim 1 , further comprising:
storing the first set of data in memory based on the detection of the suspicious event.
3. The method of claim 1 , wherein the obtaining of the first set of data further comprises:
obtaining process data associated with the first client device.
4. The method of claim 3 , wherein the obtaining of the process data further comprises:
obtaining data associated with: a user logging onto the first client device, a user logging the first client device onto a network, writing to a file, obtaining access to a file, deleting a file, writing to a registry key, a process launch from an executable, or use of a command line argument, or a combination thereof.
5. The method of claim 1 , wherein the increase in resource consumption is based on a current usage of computing resources, a future usage of computing resources, an availability of current computing resources, or an available of future computing resources, or a combination thereof.
6. The method of claim 5 , wherein the increase in resource consumption is based on network bandwidth, processing power, or a storage amount, or a combination thereof.
7. The method of claim 1 , wherein the pre-configured data filter is a default data filter that is initially applied to all client devices within the enterprise.
8. A computing device for adaptive security filtering on a plurality of client devices within an enterprise, comprising:
a processor;
a memory in electronic communication with the processor; and
instructions stored in the memory, the instructions being executable by the processor to:
apply a pre-configured data filter to a first client device within the enterprise to obtain a first set of data associated with the first client device;
apply the pre-configured data filter to a second client device within the enterprise to obtain a second set of data associated with the second client device;
adjust the pre-configured data filter applied to the first client device to a first adjusted data filter that increases the amount of data obtained from the first client device based on a suspicious event detected in the first set of data;
apply the first adjusted data filter to the first client device;
adjust the pre-configured data filter applied to the second client device to a second adjusted data filter that decreases the amount of data obtained from the second client device based on an increase in resource consumption, the increase in resource consumption being caused at least in part by the increased amount of data obtained from the first client device; and
apply the second adjusted data filter to the second client device.
9. The computing device of claim 8 , wherein the instructions are further executable by the processor to:
store the first set of data in the memory based on the detection of the suspicious event.
10. The computing device of claim 8 , wherein when the processor obtains the first set of data, the instructions are further executable to:
obtain process data associated with the first client device.
11. The computing device of claim 10 , wherein when the processor obtains the process data, the instructions are further executable to:
obtain data associated with: a user logging onto the first client device, a user logging the first client device onto a network, writing to a file, obtaining access to a file, deleting a file, writing to a registry key, a process launch from an executable, or use of a command line argument, or a combination thereof.
12. The computing device of claim 8 , wherein the increase in resource consumption is based on a current usage of computing resources, a future usage of computing resources, an availability of current computing resources, or an available of future computing resources, or a combination thereof.
13. The computing device of claim 12 , wherein the increase in resource consumption is based on network bandwidth, processing power, or a storage amount, or a combination thereof.
14. The computing device of claim 8 , wherein the pre-configured data filter is a default data filter that is initially applied to all client devices within the enterprise.
15. One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for adaptive security filtering on a plurality of client devices within an enterprise, the method comprising:
applying a pre-configured data filter to a first client device within the enterprise to obtain a first set of data associated with the first client device;
applying the pre-configured data filter to a second client device within the enterprise to obtain a second set of data associated with the second client device;
adjusting the pre-configured data filter applied to the first client device to a first adjusted data filter that increases the amount of data obtained from the first client device based on a suspicious event detected in the first set of data;
applying the first adjusted data filter to the first client device;
adjusting the pre-configured data filter applied to the second client device to a second adjusted data filter that decreases the amount of data obtained from the second client device based on an increase in resource consumption, the increase in resource consumption being caused at least in part by the increased amount of data obtained from the first client device; and
applying the second adjusted data filter to the second client device.
16. The non-transitory computer-readable media of claim 15 , wherein the increase in resource consumption is based on a current usage of computing resources, a future usage of computing resources, an availability of current computing resources, or an availability of future computing resources, or a combination thereof.
17. The non-transitory computer-readable media of claim 16 , wherein the increase in resource consumption is based on network bandwidth, processing power, or a storage amount, or a combination thereof.
18. The non-transitory computer-readable media of claim 15 , wherein the obtaining of the first set of data further comprises:
obtaining process data associated with the first client device.
19. The non-transitory computer-readable media of claim 18 , wherein the obtaining of the process data further comprises:
obtaining data associated with: a user logging onto the first client device, a user logging the first client device onto a network, writing to a file, obtaining access to a file, deleting a file, writing to a registry key, a process launch from an executable, or use of a command line argument or a combination thereof.
20. The non-transitory computer-readable media of claim 15 , wherein the pre-configured data filter is a default data filter that is initially applied to all client devices within the enterprise.