Cloud environments have emerged as a durable solution for outsourcing information systems. Some of the key IaaS clouds features are multi-tenancy, elasticity and on demand availability. Tenants can create, destroy or reconfigure virtual resources with unprecedented ease. However, the same characteristics that make cloud environments agile and dynamic, also affect the ability of a security monitoring framework to successfully detect attacks in outsourced information systems. A solution to this impediment is leveraging virtual machine introspection for pulling the application-level fire- wall outside of the virtual machine it is monitoring.