# US 2020/0401492 A1 · Container-level monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401492 A1 - Document ID: US20200401492A1 - Status: Published application - Kind: A1 - Application number: 16/535,109 - Filed: 2019-08-08 - Published: 2020-12-24 - Earliest claimed: 2019-06-19 - Assignees: VMware, Inc. - Applicants: VMWARE, Inc. - Inventors: Shirish Vijayvargiya; Alok Nemchand Kataria; Rayanagouda Bheemanagouda Patil - Web page: https://patentgrep.com/patent/US20200401492A1 ## CPC - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - H04L 63/101: {Access control lists [ACL]} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 16/188: Virtual file systems - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2201/86: Event-based monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the present disclosure relate to container-level monitoring. Embodiments include detecting, by an agent of a virtual machine, an event. Embodiments include determining, by the agent of the virtual machine, an address related to the event. Embodiments include accessing, by the agent of the virtual machine, container mapping information. Embodiments include locating, by the agent of the virtual machine, the address in the container mapping information. Embodiments include determining, by the agent of the virtual machine, based on the locating, that the event is associated with a container. Embodiments include determining, by the agent of the virtual machine, one or more attributes of the container. Embodiments include determining, by the agent of the virtual machine, based on information related to the event and the one or more attributes of the container, whether to block or allow an action related to the event. ## Claims ### Claim 1 A method, comprising: detecting, by an agent of a virtual machine, an event; determining, by the agent of the virtual machine, an address related to the event; accessing, by the agent of the virtual machine, container mapping information; locating, by the agent of the virtual machine, the address in the container mapping information; determining, by the agent of the virtual machine, based on the locating, that the event is associated with a container; determining, by the agent of the virtual machine, one or more attributes of the container; and determining, by the agent of the virtual machine, based on information related to the event and the one or more attributes of the container, whether to block or allow an action related to the event. ### Claim 2 (depends on 1) The method of claim 1, wherein the event comprises a connection, and wherein the address comprises a source internet protocol (IP) address of the connection. ### Claim 3 (depends on 1) The method of claim 1, wherein the event comprises a file access, and wherein the address comprises a file path associated with the file access. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining, by the agent of the virtual machine, whether a file associated with the event is an executable file by providing the address to a service of an operating system (OS) of the virtual machine; and determining, by the agent of the virtual machine, whether to check a white list for the file based on whether the file is an executable file. ### Claim 5 (depends on 1) The method of claim 1, wherein determining the one or more attributes of the container comprises acquiring, by the agent of the virtual machine, a user identifier related to the container from the container mapping information based on the address, wherein the user identifier is used in determining whether to block or allow the action related to the event. ### Claim 6 (depends on 1) The method of claim 1, wherein determining, by the agent of the virtual machine, based on the information related to the event and the one or more attributes of the container, whether to block or allow the action related to the event comprises: providing, by the agent of the virtual machine, the information related to the event and the one or more attributes of the container to a firewall component; and receiving a block or allow decision from the firewall component. ### Claim 7 (depends on 1) The method of claim 1, wherein determining, by the agent of the virtual machine, based on the information related to the event and the one or more attributes of the container, whether to block or allow the action related to the event comprises: determining, by the agent of the virtual machine, whether a process related to the event is present in a white list; if the process is present in the white list, determining to allow the action; and if the process is not present in the white list, determining to block the action. ### Claim 8 A non-transitory computer readable medium comprising instructions to be executed in a computer system, wherein the instructions when executed in the computer system perform a method, the method comprising: detecting, by an agent of a virtual machine, an event; determining, by the agent of the virtual machine, an address related to the event; accessing, by the agent of the virtual machine, container mapping information; locating, by the agent of the virtual machine, the address in the container mapping information; determining, by the agent of the virtual machine, based on the locating, that the event is associated with a container; determining, by the agent of the virtual machine, one or more attributes of the container; and determining, by the agent of the virtual machine, based on information related to the event and the one or more attributes of the container, whether to block or allow an action related to the event. ### Claim 9 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the event comprises a connection, and wherein the address comprises a source internet protocol (IP) address of the connection. ### Claim 10 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the event comprises a file access, and wherein the address comprises a file path associated with the file access. ### Claim 11 (depends on 8) The non-transitory computer readable medium of claim 8, wherein the method further comprises: determining, by the agent of the virtual machine, whether a file associated with the event is an executable file by providing the address to a service of an operating system (OS) of the virtual machine; and determining, by the agent of the virtual machine, whether to check a white list for the file based on whether the file is an executable file. ### Claim 12 (depends on 8) The non-transitory computer readable medium of claim 8, wherein determining the one or more attributes of the container comprises acquiring, by the agent of the virtual machine, a user identifier related to the container from the container mapping information based on the address, wherein the user identifier is used in determining whether to block or allow the action related to the event. ### Claim 13 (depends on 8) The non-transitory computer readable medium of claim 8, wherein determining, by the agent of the virtual machine, based on the information related to the event and the one or more attributes of the container, whether to block or allow the action related to the event comprises: providing, by the agent of the virtual machine, the information related to the event and the one or more attributes of the container to a firewall component; and receiving a block or allow decision from the firewall component. ### Claim 14 (depends on 8) The non-transitory computer readable medium of claim 8, wherein determining, by the agent of the virtual machine, based on the information related to the event and the one or more attributes of the container, whether to block or allow the action related to the event comprises: determining, by the agent of the virtual machine, whether a process related to the event is present in a white list; if the process is present in the white list, determining to allow the action; and if the process is not present in the white list, determining to block the action. ### Claim 15 A system comprising one or more processors and a non-transitory computer readable medium comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform a method, the method comprising: detecting, by an agent of a virtual machine, an event; determining, by the agent of the virtual machine, an address related to the event; accessing, by the agent of the virtual machine, container mapping information; locating, by the agent of the virtual machine, the address in the container mapping information; determining, by the agent of the virtual machine, based on the locating, that the event is associated with a container; determining, by the agent of the virtual machine, one or more attributes of the container; and determining, by the agent of the virtual machine, based on information related to the event and the one or more attributes of the container, whether to block or allow an action related to the event. ### Claim 16 (depends on 15) The system of claim 15, wherein the event comprises a connection, and wherein the address comprises a source internet protocol (IP) address of the connection. ### Claim 17 (depends on 15) The system of claim 15, wherein the event comprises a file access, and wherein the address comprises a file path associated with the file access. ### Claim 18 (depends on 15) The system of claim 15, wherein the method further comprises: determining, by the agent of the virtual machine, whether a file associated with the event is an executable file by providing the address to a service of an operating system (OS) of the virtual machine; and determining, by the agent of the virtual machine, whether to check a white list for the file based on whether the file is an executable file. ### Claim 19 (depends on 15) The system of claim 15, wherein determining the one or more attributes of the container comprises acquiring, by the agent of the virtual machine, a user identifier related to the container from the container mapping information based on the address, wherein the user identifier is used in determining whether to block or allow the action related to the event. ### Claim 20 (depends on 15) The system of claim 15, wherein determining, by the agent of the virtual machine, based on the information related to the event and the one or more attributes of the container, whether to block or allow the action related to the event comprises: providing, by the agent of the virtual machine, the information related to the event and the one or more attributes of the container to a firewall component; and receiving a block or allow decision from the firewall component.