A computer-implemented method is disclosed in which multiple disparate data sources having a different schemas are gathered, and relationships between the data sources are determined. A blended data set is created from the multiple data sources based on the determined relationships. A current behavior of a computing system is determined, with the current behavior being indicative of an anomaly. From the blended data set, historical behaviors of the same computing system or a similar computing system are determined. The current behavior is correlated to the historical behaviors to obtain a correlation, and a response to the anomaly is determined based on the correlation. A complementary computing device and computer program product are also disclosed.