A method for operating a monitoring entity (ME) for a distributed system includes receiving, by the ME, an action message from a computing device which has information about an action it performed. The ME, generates, deletes and/or updates a node of a data structure stored in a memory of the ME to provide an updated state of the data structure, by: processing the information of the received message, and storing the processed information into the data structure. The data structure represents knowledge about behavior of the distributed system. Each node specifies a policy by a formula, a node is linked by a trigger to one other node only to specify dependencies between nodes except for nodes with a formula, monitored by the ME, and nodes with a same formula are mutually linked by triggers. Verdict information indicating an action violating a policy is computed based on the updated state.