A first set of values for a set of metrics is obtained. A given metric of the set of metrics monitors a given component of a set of components of a computing system. The first set of values is obtained during a period of expected behavior of the computing system. One or more correlations are determined between values of the first set of values to establish one or more expected correlations between values of two or more metrics. A second set of values for the set of metrics is obtained. A determination is made as to whether values of the second set of values maintain the one or more expected correlations determined based on the first set of values.