System and method for distributed security forensics

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• creating, at a first host device configured to run a first virtualization entity, a first event index for the first virtualization entity;
• encoding at least one event related to the first virtualization entity;
• updating the first event index based on the encoded at least one event;
• and
• sending the first event index to a master console, wherein the master console is configured to receive a plurality of event indices from a plurality of host devices configured to run a plurality of virtualization entities.

A host device for efficient distributed security forensics, wherein the host device is configured to run a first virtualization entity, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• create a first event index for the first virtualization entity;
• encode at least one event related to the first virtualization entity;
• update the first event index based on the encoded at least one event;
• and
• send the first event index to a master console, wherein the master console is configured to receive a plurality of event indices created by a plurality of other host devices with respect to a plurality of virtualization entities.