A system, method and program product for managing incidents in a complex IT environment. A system is described that includes: a discovery module that analyzes an IT infrastructure and generates a topology of components and users; a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems; a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident: correlates the incident with a root cause, and determines a responsible admin and set of impacted users based on the relationship maps; and an operation engine that notifies the responsible admin and set of impacted users of the incident.