A method for operating a monitoring entity, 'ME', for a distributed system, said distributed system comprising a plurality of computing devices, said computing devices performing actions, characterized by the steps of - Receiving, by said ME, a message from a computing device, said message comprising information about one or more actions performed by said computing device, an action referring to any kind of act, activity, operation or performance, for instance concrete steps for assignment of computational resources to other virtual functions like allocating memory, freeing allocated memory, increasing or decreasing priority values for a virtual function on a processor or closing of ports of interfaces of a computing entity, - Generating, deleting and/or updating, by said ME, one or more nodes of a data structure stored in a memory of said ME, by - processing the information of said received message and - storing the processed information into said data structure, wherein said data structure represents knowledge about the behavior of said distributed system, and wherein - each node specifies a policy for actions by a formula, a formula comprising one or more logical expressions of propositions, - a node, not monitored by said ME, is linked by a trigger to one other node only, a trigger referring to a virtual communication channel, reference, pointer or link in a data structure associating at least two elements or entries in the data structure, e.g. nodes, wherein said trigger only specifies dependencies between nodes, - a node, monitored by said ME, may have more than one trigger and wherein - nodes with the same formula are mutually linked by triggers, - Computing verdict information indicating one or more actions violating one or more policies based on the updated state of said data structure. - Receiving, by said ME, a message from a computing device, said message comprising information about one or more actions performed by said computing device, an action referring to any kind of act, activity, operation or performance, for instance concrete steps for assignment of computational resources to other virtual functions like allocating memory, freeing allocated memory, increasing or decreasing priority values for a virtual function on a processor or closing of ports of interfaces of a computing entity, - Generating, deleting and/or updating, by said ME, one or more nodes of a data structure stored in a memory of said ME, by - processing the information of said received message and - storing the processed information into said data structure, wherein said data structure represents knowledge about the behavior of said distributed system, and wherein - each node specifies a policy for actions by a formula, a formula comprising one or more logical expressions of propositions, - a node, not monitored by said ME, is linked by a trigger to one other node only, a trigger referring to a virtual communication channel, reference, pointer or link in a data structure associating at least two elements or entries in the data structure, e.g. nodes, wherein said trigger only specifies dependencies between nodes, - a node, monitored by said ME, may have more than one trigger and wherein - nodes with the same formula are mutually linked by triggers, - processing the information of said received message and - storing the processed information into said data structure, wherein said data structure represents knowledge about the behavior of said distributed system, and wherein - each node specifies a policy for actions by a formula, a formula comprising one or more logical expressions of propositions, - a node, not monitored by said ME, is linked by a trigger to one other node only, a trigger referring to a virtual communication channel, reference, pointer or link in a data structure associating at least two elements or entries in the data structure, e.g. nodes, wherein said trigger only specifies dependencies between nodes, - a node, monitored by said ME, may have more than one trigger and wherein - nodes with the same formula are mutually linked by triggers, - Computing verdict information indicating one or more actions violating one or more policies based on the updated state of said data structure.