According to an exemplary embodiment of the present disclosure, disclosed is a computer program stored in a computer readable storage medium including encoded commands. When the computer program is executed by one or more processors of the computer system, the computer program allows the one or more processors to perform operations for generating a potential event related to an abnormal situation of an IT system. The operations include: an operation of collecting performance information data obtained by measuring values of performance indicators of a host which is a monitoring target in the IT system during a predetermined period; an operation of generating a first window with a predetermined size to be applied to the performance information data; an operation of determining a first statistical representative value of the performance information data included in the first window; an operation of generating a second window to be applied to the performance information data in which the second window has the same size as the first window and is spaced apart from the first window with a predetermined interval; an operation of determining a second statistical representative value of the performance information data included in the second window; and an operation of determining a potential event related with an abnormal situation in the IT system, at least partially based on the first statistical representative value and the second statistical representative value.