A computerized method of remediation in an operating system, the method comprising: querying a stateful model to retrieve a group of entities related to a given program running in the operating system, the stateful model being a logical data structure representing composition and state of the operating system in a live environment, the stateful model including a network of one or more interconnected objects representing one or more entities constituting the operating system, and one or more attributes characterizing each object, said objects being divided into one or more groups each representing a corresponding group of entities related to a respective program or part thereof running in the operating system, wherein each of said objects are divided, by an event parsing module, into the one or more groups in accordance with a predefined grouping rule set, wherein the predefined grouping rule set includes a first rule of creating a new group if a source of a process creation operation is a designated system entity and a second rule indicating a group is terminated if a target of a process termination operation is a last entity alive in the group, and wherein each of the one or more attributes of each object including at least: i) a group indicator indicating to which group said object belongs, ii) one or more operations associated with said object, said object being source or target of the associated operations, said associated operations being linked to the given program, iii) one or more interconnections between said object and one or more other objects through the associated operations, and iv) metadata, wherein the metadata is inferred by applying predefined algorithms to event data originating from the live environment, and wherein the metadata includes an organization layer that establishes an order between the entities; analyzing the stateful model to identify one or more behaviors including at least one malicious behavior, the analyzing taking into consideration the one or more interconnections; terminating at least a sub set of said group of entities related to the given program; generating a remediation plan including one or more operations linked to the given program, said one or more operations being retrieved based on said group in the stateful model; and executing the remediation plan by undoing at least part of said one or more operations linked to the given program thereby restoring state of the operating system to a state prior to the given program being executed. querying a stateful model to retrieve a group of entities related to a given program running in the operating system, the stateful model being a logical data structure representing composition and state of the operating system in a live environment, the stateful model including a network of one or more interconnected objects representing one or more entities constituting the operating system, and one or more attributes characterizing each object, said objects being divided into one or more groups each representing a corresponding group of entities related to a respective program or part thereof running in the operating system, wherein each of said objects are divided, by an event parsing module, into the one or more groups in accordance with a predefined grouping rule set, wherein the predefined grouping rule set includes a first rule of creating a new group if a source of a process creation operation is a designated system entity and a second rule indicating a group is terminated if a target of a process termination operation is a last entity alive in the group, and wherein each of the one or more attributes of each object including at least: i) a group indicator indicating to which group said object belongs, ii) one or more operations associated with said object, said object being source or target of the associated operations, said associated operations being linked to the given program, iii) one or more interconnections between said object and one or more other objects through the associated operations, and iv) metadata, wherein the metadata is inferred by applying predefined algorithms to event data originating from the live environment, and wherein the metadata includes an organization layer that establishes an order between the entities; i) a group indicator indicating to which group said object belongs, ii) one or more operations associated with said object, said object being source or target of the associated operations, said associated operations being linked to the given program, iii) one or more interconnections between said object and one or more other objects through the associated operations, and iv) metadata, wherein the metadata is inferred by applying predefined algorithms to event data originating from the live environment, and wherein the metadata includes an organization layer that establishes an order between the entities; analyzing the stateful model to identify one or more behaviors including at least one malicious behavior, the analyzing taking into consideration the one or more interconnections; terminating at least a sub set of said group of entities related to the given program; generating a remediation plan including one or more operations linked to the given program, said one or more operations being retrieved based on said group in the stateful model; and executing the remediation plan by undoing at least part of said one or more operations linked to the given program thereby restoring state of the operating system to a state prior to the given program being executed.