A cloud-based operating-system-event and data-access monitoring method (200, 300), the method comprising: a) collecting (202, 302) real-time continuous event information from a plurality of cloud-based elements, wherein collecting real-time continuous event information comprises collecting real-time continuous event information from a containerization platform running on an operating system kernel, the real-time continuous event information being time stamped based on a time at which the event occurred, and the collected event information comprising at least one of a container name and a container ID associated with a monitored process; b) generating (204, 500) one or more structured event payloads based on the collected time stamped event information; c) validating (206, 312) the one or more structured event payloads and from the validated one or more structured event payloads producing one or more validated event collections; d) serializing the one or more validated event collections into a real-time event stream; e) filtering the one or more validated event collections to remove redundant structured event payloads and produce a filtered real-time event stream; f) de-serializing and ordering the filtered real-time event stream into validated event collections and producing a time-sequenced, ordered event stream from the filtered real-time event stream; g) de-duplicating the validated event collections in the time-sequenced, ordered event stream to remove duplicate structured event payloads; and h) processing (214, 216, 218, 318) the time-sequenced, ordered event stream using individual event analysis on the collected event information to generate processed information security results. a) collecting (202, 302) real-time continuous event information from a plurality of cloud-based elements, wherein collecting real-time continuous event information comprises collecting real-time continuous event information from a containerization platform running on an operating system kernel, the real-time continuous event information being time stamped based on a time at which the event occurred, and the collected event information comprising at least one of a container name and a container ID associated with a monitored process; b) generating (204, 500) one or more structured event payloads based on the collected time stamped event information; c) validating (206, 312) the one or more structured event payloads and from the validated one or more structured event payloads producing one or more validated event collections; d) serializing the one or more validated event collections into a real-time event stream; e) filtering the one or more validated event collections to remove redundant structured event payloads and produce a filtered real-time event stream; f) de-serializing and ordering the filtered real-time event stream into validated event collections and producing a time-sequenced, ordered event stream from the filtered real-time event stream; g) de-duplicating the validated event collections in the time-sequenced, ordered event stream to remove duplicate structured event payloads; and h) processing (214, 216, 218, 318) the time-sequenced, ordered event stream using individual event analysis on the collected event information to generate processed information security results.