Incident Triage Scoring Engine

A computer-implemented method comprising:

• receiving data that identifies a computer security threat to a computing device and that includes log data associated with the computer security threat and with the computing device;
• based on the computer security threat, identifying a workflow that identifies one or more actions to remediate the computer security threat;
• executing the workflow by:
• determining a network threat confidence score based on IP addresses identified in the log data;
• determining a process threat confidence score based on processes identified in the log data;
• and
• determining a file threat confidence score based on modified files identified in the log data;
• determining a threat confidence score based on the network threat confidence score, the process threat confidence score, and the file threat confidence score;
• and
• identifying additional processing to remediate the computer security threat based on the threat confidence score.

A system, comprising:

• one or more processors;
• and
• a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for responding to a computer security threat, the operations comprising:
• receiving data that identifies a computer security threat to a computing device and that includes log data associated with the computer security threat and with the computing device;
• based on the computer security threat, identifying a workflow that identifies one or more actions to remediate the computer security threat;
• executing the workflow by:
• determining a network threat confidence score based on IP addresses identified in the log data;
• determining a process threat confidence score based on processes identified in the log data;
• and
• determining a file threat confidence score based on modified files identified in the log data;
• determining a threat confidence score based on the network threat confidence score, the process threat confidence score, and the file threat confidence score;
• and
• identifying additional processing to remediate the computer security threat based on the threat confidence score.

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for responding to a computer security threat, the operations comprising:

• receiving data that identifies a computer security threat to a computing device and that includes log data associated with the computer security threat and with the computing device;
• based on the computer security threat, identifying a workflow that identifies one or more actions to remediate the computer security threat;
• executing the workflow by:
• determining a network threat confidence score based on IP addresses identified in the log data;
• determining a process threat confidence score based on processes identified in the log data;
• and
• determining a file threat confidence score based on modified files identified in the log data;
• determining a threat confidence score based on the network threat confidence score, the process threat confidence score, and the file threat confidence score;
• and
• identifying additional processing to remediate the computer security threat based on the threat confidence score.