Incident Response Plan based on Indicators of Compromise

A method for responding to data security incidents in an enterprise network, the method comprising:

• creating, in an incident manager (IM), incident objects for data security incidents, wherein the incident objects include incident characteristics;
• storing, in the IM, one or more indicators of compromise (IOC) associated with the incident objects;
• creating tasks for incident objects based upon the incident characteristics of the incident objects;
• generating incident response plans for the data security incidents that include the tasks based upon the incident characteristics of the incident objects;
• and
• in response to receiving updated incident characteristics for the incident objects, creating tasks based on the updated incident characteristics for the incident objects, and generating the incident response plans for the data security incidents to include the tasks based on the updated incident characteristics for the incident objects.

A system for responding to data security incidents, the system comprising:

• an incident manager (IM) that creates incident objects for data security incidents, wherein the incident objects include incident characteristics, and that creates one or more indicators of compromise (IOC) associated with the incident objects;
• and
• a rules engine of the IM that:
• creates tasks for the incident objects based upon the incident characteristics of the incident objects;
• determines tasks for the incident objects based upon the one or more IOCs associated with the incident objects;
• and
• generates incident response plans for the data security incidents, wherein the incident response plans for the data security incidents include the tasks based upon the incident characteristics of the incident objects, and include the tasks based upon the one or more IOCs associated with the incident objects.

A system for responding to data security incidents, comprising:

• an incident manager (IM) that creates incident objects for data security incidents, wherein the incident objects include incident characteristics, and that creates one or more indicators of compromise (IOC) associated with the incident objects;
• and
• a rules engine of the IM that:
• creates tasks for the incident objects based upon the incident characteristics of the incident objects;
• generates incident response plans for the data security incidents that include the tasks based upon the incident characteristics for the incident objects;
• and
• receives updated incident characteristics for the incident objects, and in response, determines tasks based on the updated incident characteristics for the incident objects, and regenerates the incident response plans for the data security incidents to include the tasks based on the updated incident characteristics.