receiving, by a threat response computer, an event report from a threat detector which monitors and analyzes communications between a client computer in an enterprise computing network and a plurality of computers, wherein the threat response computer is separate from the client computer and runs on a threat response platform configured for protecting the enterprise computing network, and wherein the event report includes data identifying a suspicious communication by the client computer as a security event;

in response to the receiving of the event report by the threat response computer, temporarily, automatically, and remotely placing and activating, by the threat response computer, an agent on the client computer, the agent configured to search for potential indications of compromise (IOCs) on the client computer and self-uninstall after sending search result data to the threat response computer;

determining, by the threat response computer, whether the potential IOCs on the client computer indicate evidence of malware on the client computer in the enterprise computing network by:

responsive to a result of the determining whether the potential IOCs on the client computer indicate evidence of malware on the client computer comprising a determination that the potential IOCs on the client computer indicate the evidence of malware on the client computer in the enterprise computing network, performing, by the threat response computer, one or more of: