1. A method comprising: receiving a parameter of a device at a kernel level of a software stack associated with the device, wherein the parameter comprises a pattern of operation; analyzing the parameter at the kernel level of the software stack to determine an event state; comparing the event state to a white list to determine a state of an alert trigger, wherein the white list comprises acceptable patterns of operation, wherein the acceptable patterns of operation comprise physical patterns; generating an alert in response to the determined state of the alert trigger; transmitting the alert to a review device for analysis and determination of a response; receiving the response from the review device, wherein remediation measures to address the event state are not taken until the response from the reviewer device is received; and causing, in response to the received response from the review device, implementation of the remediation measures to address the event state.