A system and method for conducting a computerized surveillance in a computerized environment, including: initiating an installation of an agent on an endpoint device (EPD) in response to an indication of a potential malicious activity executed on the EPD; activating the agent to collect data on the EPD; based on the analysis of the collected data, selecting at least one mitigation action to be executed by the agent; and initiating an uninstallation of the agent from the EPD.