Open integration framework for cybersecurity incident management software platform

A non-transitory computer readable medium comprising software that, when executed by a processor, causes the processor to execute an open integration framework of a computerized cybersecurity incident management software platform to define integrations at an action level for integrating a plurality of cybersecurity products provided by a plurality of companies for performing desired actions into the cybersecurity incident management software platform, the open integration framework performing a method comprising iteratively performing, for respective ones of the plurality of cybersecurity products, the following steps:

• defining high-level parameters of an integration through an integration definition file, the integration definition file identifying one of the plurality of cybersecurity products, provided by one of the plurality of companies, to be called through an application program interface, the parameters defined by the integration definition file including a name of the integration, connection parameters, and identification of a self-contained virtualization in which the integration definition file is configured to be executed;
• and
• defining one or more actions of the integration through one or more respective action definition files that define details of the one or more actions, the one or more action definition files identifying the integration defined by the integration definition file, the one or more actions requiring use of the one of the plurality of cybersecurity products through the application program interface, the one or more actions being actions to be performed by the one of the plurality of cybersecurity products provided by the one of the plurality of companies, the details defined by each action definition file comprising a name of, and code to be executed by, an action to be performed by the one of the plurality of cybersecurity products, provided by the one of the plurality of companies, identified by the integration definition file;
• through a user interface, electing to an-add the integration, and then selecting the integration definition file from a set of integration definition files;
• and
• through the user interface, electing to add the one or more actions to be performed by the one of the plurality of cybersecurity products identified by the integration definition file, and then selecting the one or more action definition files from a set of action definition files.