A computer-implemented method includes receiving, from a first log agent, a first log collection. The computer-implemented method further includes receiving a first policy, wherein the first policy includes a definition of a first pattern and a definition of a procedure. The computer-implemented method further includes scanning the first log collection against the first policy to determine a match between a portion of the first log collection and the first pattern, with the matching portion of the first log collection being identified as a first data artefact. The computer-implemented method further includes, responsive to identifying the first data artefact, executing the procedure defined by the first policy, wherein the procedure includes: filtering the first log collection to yield a first group of filtered log entries, receiving a first data collection, and sending the first group of filtered log entries and the first data collection to a recipient system.