State-based entity behavior analysis

A computer program product comprising a non-transitory computer readable medium storing instructions executable by a processor to perform a set of operations, the set of operations comprising:

• receiving an event associated with an entity of a computing environment;
• determining that the received event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity;
• evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network;
• when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network;
• and
• performing an action for the entity based on the entity being associated with the second place of the PT network.

A method of processing an evet associated with an entity comprising:

• receiving an indication of an event associated with the entity in a computing environment;
• determining that the event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity;
• evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network;
• when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network;
• and
• performing an action for the entity based on the entity being associated with the second place of the PT network.

A system for processing an evet associated with an entity:

• a processor;
• and
• a non-transitory computer readable medium storing instructions translatable by the processor, the instructions when translated by the processor perform:
• receiving an event associated with an entity of a computing environment;
• determining that the received event represents one of a plurality of predefined state change transitions of the entity, the plurality of predefined state change transitions stored in association with a place/transition (PT) network for the entity;
• evaluating the event using the one of the plurality of predefined state change transitions to determine whether the entity should transition from a first place to a second place of the PT network;
• when it is determined that the entity should transition from the first place to the second place, associating the entity with the second place of the PT network;
• and
• performing an action for the entity based on the entity being associated with the second place of the PT network.