Abstract: A server has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect operating signals from machines. The operating signals characterize establishing or closing a network connection associated with a designated application operating within a designated container. The designated container is an isolated process in user space designated by an operating system kernel. A network security policy that permits network connections based upon the operating signals collected is automatically generated.