Abstract: Systems, apparatuses, and methods are described for managing data collection and security in a network. An computing device may instruct sensors on one or more networks to collect and report data of certain data types based on modes that indicate instructions for sending and/or storing data of one or more data types. If the reported data is determined to indicate a security event, the computing device may determine additional data and/or data types useful in monitoring the security event, identify sensors based on a proximity of the sensors to the security event, and update the sensor modes based on new data collected.

Abstract: Technologies are provided for tracking network entities over time. By analyzing network log data, static identifiers (IDs) may be associated with ephemeral IDs corresponding to respective network entities. Existing associations between static IDs and ephemeral IDs may be updated over time, based on analysis of incoming network log data. Accordingly, an ephemeral ID may correspond to one static ID during a first time period, and may correspond to another static ID during a second time period.