A data processing method providing an improvement in automatically generating programmed rules to detect anomalous operations in computer systems executing containerized computer program applications, the method comprising: creating and storing, in digital data storage, a score threshold value that is associated with determining whether a baseline operation rule is to be generated; receiving, from one or more service monitoring processes that are executing on one or more computer systems, datasets of operations that have been performed on digital objects by one or more processes associated with one or more computer applications executing on the one or more computer systems, each dataset of the datasets of operations comprising a set of operations data representing records of operations that were performed by one or more particular processes associated with a particular computer application of the one or more computer applications; aggregating operations represented in the datasets of operations and identifying operation properties from the aggregated operations to generate an aggregated baseline dataset that represents operation properties identified from aggregated operations that are grouped by common identifiers associated with the operations; assigning score values to each of the operation properties in the aggregated baseline dataset, wherein the assigning score values is performed so that each assigned score value represents whether a particular operation property is a candidate for generating a rule that defines expected operation property values for the particular operation property; and automatically generating a set of baseline operations rules for only those operation properties in the aggregated baseline dataset that have assigned values that exceed the score threshold value, for the set of baseline operations rules being programmed to detect anomalous operations that contain unexpected operation property values. creating and storing, in digital data storage, a score threshold value that is associated with determining whether a baseline operation rule is to be generated; receiving, from one or more service monitoring processes that are executing on one or more computer systems, datasets of operations that have been performed on digital objects by one or more processes associated with one or more computer applications executing on the one or more computer systems, each dataset of the datasets of operations comprising a set of operations data representing records of operations that were performed by one or more particular processes associated with a particular computer application of the one or more computer applications; aggregating operations represented in the datasets of operations and identifying operation properties from the aggregated operations to generate an aggregated baseline dataset that represents operation properties identified from aggregated operations that are grouped by common identifiers associated with the operations; assigning score values to each of the operation properties in the aggregated baseline dataset, wherein the assigning score values is performed so that each assigned score value represents whether a particular operation property is a candidate for generating a rule that defines expected operation property values for the particular operation property; and automatically generating a set of baseline operations rules for only those operation properties in the aggregated baseline dataset that have assigned values that exceed the score threshold value, for the set of baseline operations rules being programmed to detect anomalous operations that contain unexpected operation property values.