1. A method, comprising: identifying an event produced in response to an application that processes; obtaining an application identity for the application; acquiring metadata associated with the application identity; and evaluating at least some of the metadata to generate a secure package, wherein the secure package includes the event and the application identity.