Model-based computer attack analytics orchestration

A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for model-based computer attack analytics orchestration, the machine-readable storage medium comprising instructions to cause the hardware processor to:

• select an attack model from a plurality of attack models using contextual data that describes a state of a computing system, the attack model specifying behavior of a particular attack on the computing system;
• generate, using the attack model, a hypothesis for the particular attack, the hypothesis specifying, for a particular state of the particular attack, a plurality of attack actions;
• identify, using the hypothesis, at least one analytics function for determining whether the plurality of attack actions specified by the hypothesis occurred on the computing system;
• provide an analytics device with instructions to execute the at least one analytics function on the computing system;
• receive analytics results from the analytics device;
• and
• update a state of the attack model based on the analytics results.