1. A method for computer system forensics, comprising: monitoring traffic passing through network switching elements in a computer network comprising multiple host computers; identifying an anomalous message in the monitored traffic passing through network switching elements; defining a filter responsive to the identified anomalous message; transmitting the filter to respective monitoring programs running on the multiple host computers; monitoring messages transmitted by the multiple host computers, by the respective monitoring programs, so as to detect messages matching the defined filter; detecting, by the respective monitoring programs on the multiple host computers, for each message matching the defined filter, a respective process that initiated the message; sampling by a forensic analyzer of the computer network from the multiple host computers, lists of messages matching the defined filter and corresponding processes that initiated the message; responsively to the sampled lists from the multiple host computers, extracting a forensic indicator characteristic of the respective processes that initiated the matching messages; and applying preventive actions to processes matching the extracted forensic indicator, on the multiple host computers.