1. A method, comprising: performing, by one or more computing devices: receiving a message comprising information indicative of an event detected on one of a plurality of nodes in a distributed computing system; accessing a knowledge base comprising information associated with known computing system attack patterns; classifying the event as being representative of one of the known computing system attack patterns or as being representative of an unknown attack pattern, dependent, at least in part, on said accessing; and initiating a response to the event, dependent on said classifying; wherein in response to classifying the attack as an unknown attack pattern, said initiating a response comprises one or more of: performing a clustering analysis to identify a known attack pattern sharing at least some characteristics with the unknown attack pattern, randomly selecting a response action, or simulating the unknown attack pattern.