A method for cloud-based, control-plane-event monitoring, the method comprising: a) receiving control-plane events from a cloud-based element (312, 314, 316, 318) associated with a first cloud environment (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684), wherein at least one of the received control-plane events comprises a first event type with a first format of two different formats; b) receiving control-plane events from a cloud-based element (312, 314, 316, 318) associated with a second cloud environment (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684), wherein at least one of the received control-plane events comprises a second event type with a second format of the two different formats; c) generating a multiple-source data set from the control-plane events from the cloud-based elements (312, 314, 316, 318) associated with the first and second cloud environments (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684); d) evaluating the multiple-source data set based on attributes of the first and second cloud environments (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684) and, thereby generating a common event data set; and e) processing the common event data set using a rule set to generate alerts, identify policy violations, publish reports, remediate threats and/or modify non-compliant infrastructure into compliant configurations; characterised in that the first event type and the second event type are a common event type; the evaluating the multiple-source data set includes processing the control-plane events from the cloud-based elements associated with the first and second cloud environments such that they are rendered into events in a common structure with the same fields; and the evaluating the multiple-source data set includes transforming the at least one of the received control-plane events comprising the first format of the two different formats and the at least one of the received control-plane events comprising the second format of the two different formats into the common event structure and results in unifying event data in the multiple-source data set by transforming control-plane events into the common event structure that is compatible with downstream event processing. a) receiving control-plane events from a cloud-based element (312, 314, 316, 318) associated with a first cloud environment (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684), wherein at least one of the received control-plane events comprises a first event type with a first format of two different formats; b) receiving control-plane events from a cloud-based element (312, 314, 316, 318) associated with a second cloud environment (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684), wherein at least one of the received control-plane events comprises a second event type with a second format of the two different formats; c) generating a multiple-source data set from the control-plane events from the cloud-based elements (312, 314, 316, 318) associated with the first and second cloud environments (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684); d) evaluating the multiple-source data set based on attributes of the first and second cloud environments (202, 204, 206, 304, 306, 308, 402, 500, 602, 604, 622, 624, 642, 644, 662, 664, 682, 684) and, thereby generating a common event data set; and e) processing the common event data set using a rule set to generate alerts, identify policy violations, publish reports, remediate threats and/or modify non-compliant infrastructure into compliant configurations; characterised in that the first event type and the second event type are a common event type; the evaluating the multiple-source data set includes processing the control-plane events from the cloud-based elements associated with the first and second cloud environments such that they are rendered into events in a common structure with the same fields; and the evaluating the multiple-source data set includes transforming the at least one of the received control-plane events comprising the first format of the two different formats and the at least one of the received control-plane events comprising the second format of the two different formats into the common event structure and results in unifying event data in the multiple-source data set by transforming control-plane events into the common event structure that is compatible with downstream event processing.