Cybersecurity alert, assessment, and remediation engine

A non-transitory computer readable storage medium storing one or more programs that are executed by one or more processors of a cybersecurity system to perform operations, comprising:

• receiving a security alert that indicates a threat to the cybersecurity system;
• extracting data elements from the security alert, the data elements including at least one of an internet protocol (IP) address, a hash, an alert priority, an alert type, a description of the threat, or a hostname;
• using the data elements to obtain additional information regarding the security alert, the additional information including at least one of a domain name, a domain name system (DNS) address, the description of the threat, a confidence level of the threat or a result of a DNS lookup query or a domain query;
• adding the additional information regarding the security alert as new data elements of the security alert;
• ranking the security alert in importance based on the data elements and new data elements of the security alert;
• re-ranking the security alert when any of the data elements of the security alert change, when a new security alert is received or based on an amount of time since the security alert was assigned for resolution or an amount of time since the security alert was received or updated;
• and
• issuing a command to take a programmed action for the security alert based on the data elements and the security alert ranking using an if this then that (IFTTT) expert system.