A solution is proposed for identifying software components in a computing system. A corresponding method comprises monitoring events relating to one or more software components of the computing system, filtering the events into filtered events according to finalizing events of corresponding event sequences ending with the finalizing events, each of the event sequences relating to a logical operation for a corresponding current software component of the software components being finalized by the finalizing events, and determining corresponding current signatures of the current software components of the filtered events, each of the current signatures being determined according to at least part of a content of the corresponding current software component for use to identify the current software component according to a comparison of the current signature with one or more known signatures of known software components.