Determining security actions for security threats using enrichment information

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

• identifying a security threat within a computing environment, wherein the security threat comprises a potentially malicious process executing on an asset of a plurality of computing assets;
• obtaining state information for the security threat, wherein the state information indicates at least one of:
• a type of information the security threat seeks to obtain, a type of computing system targeted by the security threat, and a communication path of the security threat;
• obtaining enrichment information about the potentially malicious process executing on the asset of the plurality of computing assets;
• determining that the potentially malicious process is a malicious process based on the enrichment information;
• determining a plurality of security actions for responding to the security threat based on the enrichment information and the state information for the security threat;
• causing display of the plurality of security actions in a ranked order;
• obtaining a selection of one or more security actions of the plurality of security actions;
• and
• translating the one or more security actions into processes implemented on the asset of the plurality of computing assets.

An apparatus, comprising:

• one or more processors;
• a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
• identify a security threat within a computing environment, wherein the security threat comprises a potentially malicious process executing on an asset of a plurality of computing assets;
• obtain state information for the security threat, wherein the state information indicates at least one of:
• a type of information the security threat seeks to obtain, a type of computing system targeted by the security threat, and a communication path of the security threat;
• obtain enrichment information about the potentially malicious process executing on the asset of the plurality of computing assets;
• determine that the potentially malicious process is a malicious process based on the enrichment information;
• determine a plurality of security actions for responding to the security threat based on the enrichment information and the state information for the security threat;
• cause display of the plurality of security actions in a ranked order;
• obtain a selection of one or more security actions of the plurality of security actions;
• and
• translate the one or more security actions into processes implemented on the asset of the plurality of computing assets.