Aspects of the disclosure relate to monitoring devices at enterprise locations using machine-learning models to protect enterprise-managed information and resources. In some embodiments, a computing platform may receive, from one or more data source computer systems, passive monitoring data. Based on applying a machine-learning classification model to the passive monitoring data received from the one or more data source computer systems, the computing platform may determine to trigger a data capture process at an enterprise center. In response to determining to trigger the data capture process, the computing platform may initiate an active monitoring process to capture event data at the enterprise center. Thereafter, the computing platform may generate one or more alert messages based on the event data captured at the enterprise center. Then, the computing platform may send the one or more alert messages to one or more enterprise computer systems.