Action response framework for data security incidents

A system for responding to data security incidents in an enterprise network, the system comprising:

• one or more devices responsible for security on the enterprise network;
• and
• an incident manager application, the incident manager application comprising computer program instructions executed in a hardware processor, the computer program instructions configured to perform a set of operations including:
• storing information concerning the data security incidents, the information comprising at least one incident object for at least one data security incident, and one or more incident artifacts for data resources identified within the incident object, wherein the incident object and the incident artifacts are organized as an object-oriented inheritance hierarchy;
• comparing the information to one or more action conditions to determine any action condition satisfied by the information;
• combining into a message contents of any incident object and incident artifact associated with a satisfied action condition;
• providing the message to the one or more devices in the enterprise network, thereby facilitating a response to a data security incident associated with the satisfied action condition.