In this talk, we will discuss incident management using Hawkes processes within an IT infrastructure. We show how a model previously applied for earthquake predictions can help answer the question ‘what caused what’ in a major European bank.