Methods, systems, and computer-readable media with executable instructions stored thereon for determining root cause are provided. A method for determining root cause can include receiving values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics, receiving an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system, and determining a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value.