Abstract: Embodiments of the invention provide novel systems, methods and software for searching and/or analyzing text, based on a list of one or more keywords of interest. In a set of embodiments, a first computer generates a regular expression satisfied by a particular keyword of interest as well as a hash value corresponding to the keyword. In some embodiments, the regular expression and the hash value are transmitted to a second computer, which identifies a set of text associated with a particular event and/or evaluates the set of text against the regular expression. If the text satisfies the regular expression, the second computer might generate a text hash from the text. This text hash can be compared with the hash from the package, and if there is a match, the event might be identified as requiring monitoring, collection and/or further analysis.

Abstract: Embodiments of the invention provide systems, software and methods for monitoring events on a computer. In a set of embodiments, a monitoring application monitors events on a monitored computer. Each of the monitored events may be analyzed, and based on the analysis, some or all of the monitored events may be collected. A variety of rules may be used in analyzing events. In some cases, collected events can be queued, for example, by storing a representation of each collected event in an event cache. When connectivity with a monitoring computer is available, a connection with the monitoring computer may be established, and/or the queued events may be transmitted to the monitoring computer. In a particular set of embodiments, the monitoring application is designed to avoid detection by a user of the monitored computer.