1. A computer-implemented method, comprising: receiving a message comprising information indicative of an event detected on one of a plurality of nodes in a distributed computing system; accessing a knowledge base comprising information associated with known computing system attack patterns; classifying the event as being representative of one of the known computing system attack patterns or as being representative of an unknown attack pattern, dependent, at least in part, on said accessing; and initiating a response to the event, dependent on said classifying.