Incident triage scoring engine

A system, comprising:

• one or more processors;
• and
• a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to execute a continuous machine learning process to generate a workflow, the operations comprising:
• receiving data identifying two or more groups of actions performed to remediate a computer security threat;
• determining first unique paths from a first action of each of the two or more groups of actions to a second action of each of the two or more groups of actions;
• determining second unique paths from the second action of each of the two or more groups of actions to a third action of each of the two or more groups of actions;
• combining common paths among the first unique paths and the second unique paths;
• identifying one of the common paths that appears most frequently;
• and
• determining a core path that includes a subset of the actions of the two or more groups of actions based on the one of the common paths that appears most frequently.

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for generating a workflow executed to respond to a computer security threat, the operations comprising:

• receiving data identifying two or more groups of actions performed to remediate the computer security threat;
• determining first unique paths from a first action of each of the two or more groups of actions to a second action of each of the two or more groups of actions;
• determining second unique paths from the second action of each of the two or more groups of actions to a third action of each of the two or more groups of actions;
• combining common paths among the first unique paths and the second unique paths;
• identifying one of the common paths that appears most frequently;
• and
• determining a core path that includes a subset of the actions of the two or more groups of actions based on the one of the common paths that appears most frequently.