Distributed network black box using crowd-based cooperation and attestation

Presented herein are techniques for obtaining pertinent information from a network upon detection of an anomaly by receiving, at a first network node, configuration information sufficient to establish a data collection policy for the network node, capturing data, on the first network node, in accordance with the data collection policy to obtain captured data, detecting an anomaly occurring with respect to a second network node, and in response to detecting the anomaly, in transferring from the first network node, to an analysis server, collected data derived from the captured data based on both the data collection policy and a proximity metric indicating a logical distance between the first network node and the second network node.