Embodiments for responding to computing system incidents are provided. Information associated with a computing system is analyzed to generate a base system model of the computing system. The information includes at least one of system logs and metrics data of the computing system. An indication of an incident associated with the computing system is received. The base system model is utilized to analyze the incident. The analysis of the incident includes characterizing the incident as a previously detected incident or an unknown incident. A strategy for responding to the incident is identified based on the analysis of the incident.