Data is received describing attributes of a first mainframe computing system at a software appliance, where the software appliance is hosted at least in part on a second mainframe computing system and the software appliance includes a plurality of microservices hosted in a plurality of software containers. The data is sent to a first one of the plurality of microservices hosted in a first one of the plurality of software containers, where the first microservice includes data science logic. The data is analyzed using the data science logic to generate a result at the first microservice, and it is determined whether to send the result to a second one of the plurality of microservices hosted in a second one of the plurality of software containers, where the second microservice includes logic to determine an alert condition based on results received from other microservices in the software appliance.