Metadata associated with client application instances running in virtual machine (VM) platforms within virtual processing environments is collected by monitor applications also running within the VM platforms. The instance metadata is transmitted to and received by a monitor control platform which in turn stores the instance metadata within a monitor instance registry. The instance metadata is updated through solicited or unsolicited updates. The instance metadata is used to identify groups of application instances, and these groups are used to determine targets instances for monitoring or management actions based upon later detected network events such as network security or threat events. Further, trust scores can be determined for components of the metadata stored in the instance registry, and composite trust scores can be generated and used to identify on or more groups of application instances.