Isolated container event monitoring

A method in a host operating system comprising:

• receiving via a secure communication channel a security event that includes information describing potentially malicious activity detected by a container event manager running in a container that is isolated from the host operating system and resulting from an application running in the container accessing a resource in the container;
• determining whether a threat level associated with the security event satisfies a threat level threshold and if so,
• taking corrective action to mitigate the potentially malicious activity in the container;
• generating a separate security event that describes the potentially malicious activity;
• and
• comparing the security event with the separate security event to determine whether the container event manager is functioning correctly.

A computer-readable memory device having program code recorded thereon that when executed by at least one processor of a computing device causes the at least one processor to perform operations for determining a threat level of potentially malicious activity by an application running in a container isolated from a host operating system, the operations comprising:

• generating by a container event manager running in the container a security event that includes information describing the potentially malicious activity, said generating comprising:
• detecting an access to a resource by the application;
• monitoring application activity in the container while the application is accessing the resource to detect the potentially malicious activity;
• and
• responsive to detecting the potentially malicious activity in the container, generating the security event;
• communicating the security event to the host operating system via a secure communication channel;
• and
• performing by the host operating system:
• analyzing by the host operating system the security event to determine a threat level associated with the potentially malicious activity;
• generating a separate security event that describes the potentially malicious activity;
• and
• comparing the security event with the separate security event to determine whether the container event manager is functioning correctly.