Correspondence of external operations to containers and mutation events

Abstract

A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method further includes checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands. The method also includes designating, by the hardware processor, a particular external command, from among the external container commands stored in the database, as having a correspondence to the initial process, responsive to the initial process matching the at least one respective process resulting from executing the particular external command.