1. A management system for determining causal relationships among system entities, the management system comprising: at least one processor; a non-transitory computer-readable storage medium including instructions executable by the at least one processor, the instructions configured to implement, a causal relationship detector configured to receive events from a computing environment having a plurality of entities, and configured to detect causal relationships among the plurality of entities, during runtime of the computing environment, based on the events; and a rules converter configured to convert one or more of the causal relationships into at least one behavioral rule, the at least one behavioral rule indicating a causal relationship between at least two entities of the plurality of entities.