A method for determining a threat level of a potentially malicious activity by an application running in a container managed by a host operating system, wherein the container is isolated from the host operating system, the method comprising: performing by a container event manager running in the container: detecting an access to a resource by the application running in the container; monitoring application activity in the container while the application is accessing the resource; responsive to detecting potentially malicious activity in the container, generating a security event that includes information describing the potentially malicious activity; and communicating the generated security event to the host operating system via a secure communication channel; and performing by the host operating system: analyzing the communicated security event to determine the threat level associated with the potentially malicious activity detected by the container event manager running in the container, generating a separate security event that describes the potentially malicious activity, and comparing the security event generated by the container event manager with the separate security event generated by the host operating system to determine whether the container event manager is functioning correctly. performing by a container event manager running in the container: detecting an access to a resource by the application running in the container; monitoring application activity in the container while the application is accessing the resource; responsive to detecting potentially malicious activity in the container, generating a security event that includes information describing the potentially malicious activity; and communicating the generated security event to the host operating system via a secure communication channel; and detecting an access to a resource by the application running in the container; monitoring application activity in the container while the application is accessing the resource; responsive to detecting potentially malicious activity in the container, generating a security event that includes information describing the potentially malicious activity; and communicating the generated security event to the host operating system via a secure communication channel; and performing by the host operating system: analyzing the communicated security event to determine the threat level associated with the potentially malicious activity detected by the container event manager running in the container, generating a separate security event that describes the potentially malicious activity, and comparing the security event generated by the container event manager with the separate security event generated by the host operating system to determine whether the container event manager is functioning correctly. analyzing the communicated security event to determine the threat level associated with the potentially malicious activity detected by the container event manager running in the container, generating a separate security event that describes the potentially malicious activity, and comparing the security event generated by the container event manager with the separate security event generated by the host operating system to determine whether the container event manager is functioning correctly.