Systems and techniques for guiding a response to a cybersecurity incident

A system comprising:

• data processing apparatus programmed to perform operations comprising:
• identifying a plurality of security events associated with the security incident, wherein the plurality of security events include a first group of security events and a second group of security events, and wherein identifying the plurality of security events includes:
• determining that the security events in the first group are associated with the security incident, and
• determining that each security event in the second group is relevant to a respective event in the first group, wherein relevance of a first security event to a second security event is determined based on an extent to which activities or attributes of a first entity associated with the first security event influence activities or attributes of a second entity associated with the second security event;
• for two or more individual security events in the plurality of security events associated with the security incident, estimating a respective utility of investigating each individual security event;
• pruning a first, non-empty subset of the individual security events associated with the security incident based, at least in part, on the estimated utilities of investigating the pruned security events, wherein a second non-empty subset of the individual security events associated with the security incident remain after the pruning;
• and
• guiding a response to the security incident by presenting, to a user, data corresponding to the remaining subset of individual security events associated with the security incident.