Systems, Methods, Apparatuses, And Computer Program Products For Forensic Monitoring

摘要

Systems, methods, apparatuses, and computer program products are provided for forensic monitoring. A system may include a forensic analysis apparatus and one or more monitored apparatuses. A monitored apparatus may monitor activity on the monitored apparatus and extract forensic data based at least in part on monitored activity. The forensic data may be transferred from the monitored apparatus to the forensic analysis apparatus for processing and analysis.

主权项

1. A method for forensic monitoring, comprising:
monitoring activity on a monitored apparatus; extracting, by a processor, forensic data based at least in part on monitored activity; causing transfer of the extracted forensic data from the monitored apparatus to a forensic analysis apparatus configured to archive the forensic data for a later analysis; and determining, by the forensic analysis apparatus, one or more key risk indicator values relating to the monitored apparatus based at least in part on the later analysis, wherein the key risk indicator values indicate potential risks of intrusion.