A cloud-based operating-system-event and data-access monitoring method , the method comprising: a) collecting real-time continuous event information from a plurality of cloud-based elements , wherein collecting real-time continuous event information comprises collecting real-time continuous event information from a containerization platform running on an operating system kernel , the real-time continuous event information being time stamped based on a time at which the event occurred, and the collected event information comprising at least one of a container name and a container ID associated with a monitored process; b) generating one or more structured event payloads based on the collected time stamped event information; c) validating the one or more structured event payloads and from the validated one or more structured event payloads producing one or more validated event collections; d) serializing the one or more validated event collections into a real-time event stream; e) filtering the one or more validated event collections to remove redundant structured event payloads and produce a filtered real-time event stream; f) de-serializing and ordering the filtered real-time event stream into validated event collections and producing a time-sequenced, ordered event stream from the filtered real-time event stream; g) de-duplicating the validated event collections in the time-sequenced, ordered event stream to remove duplicate structured event payloads; and h) processing the time-sequenced, ordered event stream using individual event analysis on the collected event information to generate processed information security results. a) collecting real-time continuous event information from a plurality of cloud-based elements , wherein collecting real-time continuous event information comprises collecting real-time continuous event information from a containerization platform running on an operating system kernel , the real-time continuous event information being time stamped based on a time at which the event occurred, and the collected event information comprising at least one of a container name and a container ID associated with a monitored process; b) generating one or more structured event payloads based on the collected time stamped event information; c) validating the one or more structured event payloads and from the validated one or more structured event payloads producing one or more validated event collections; d) serializing the one or more validated event collections into a real-time event stream; e) filtering the one or more validated event collections to remove redundant structured event payloads and produce a filtered real-time event stream; f) de-serializing and ordering the filtered real-time event stream into validated event collections and producing a time-sequenced, ordered event stream from the filtered real-time event stream; g) de-duplicating the validated event collections in the time-sequenced, ordered event stream to remove duplicate structured event payloads; and h) processing the time-sequenced, ordered event stream using individual event analysis on the collected event information to generate processed information security results. <EOS>