A computing device includes a processor and a medium storing instructions. The instructions are executable by the processor to: detect an information technology (IT) event associated with an IT system; determine an event class for the IT event; identify a plurality of event-procedure relations associated with the determined event class, each of the plurality of event-procedure relations having an associated success score; select a first event-procedure relation having a highest success score, wherein the first event-procedure relation specifies a relation between the determined event class and a first remediation procedure; and execute the selected first remediation procedure to remediate the IT event.