Methods and systems for processing cyber incidents in cyber incident management systems using dynamic processing hierarchies

A method for processing cyber incidents in cyber incident management systems using dynamic processing hierarchies, the method comprising:

• receiving, via a user interface, a user request to process a cyber incident through an integrated cyber incident management system, wherein the cyber incident includes an incident characteristic;
• retrieving, using control circuitry, a first structure for a cyber incident management system, wherein the first structure defines a first hierarchy of tasks through which cyber incidents are automatically processed without user inputs;
• retrieving, using the control circuitry, a second structure for the cyber incident management system, wherein the second structure defines a second hierarchy of tasks through which cyber incidents are processed based on user inputs received in response to user queries generated for display on the user interface;
• comparing, using the control circuitry, the incident characteristic to incident characteristics in a database of historical incidents to determine a shared structure node for transitioning from the first hierarchy of tasks to the second hierarchy of tasks at the shared structure node;
• generating, using the control circuitry, an integrated structure by combining the first structure and the second structure at the shared structure node;
• processing the cyber incident through the integrated structure to the shared structure node;
• and
• generating for display, on the user interface, a user query comprising native data, for the cyber incident, and integration data that describes, in a human-readable format, a relationship of the native data to the integrated structure.

A non-transitory, computer-readable medium for processing cyber incidents in cyber incident management systems using dynamic processing hierarchies, comprising instructions that, when executed by one or more processors, cause operations comprising:

• receiving, via a user interface, a user request to process a cyber incident through an integrated cyber incident management system, wherein the cyber incident includes an incident characteristic;
• retrieving a first structure for a cyber incident management system, wherein the first structure defines a first hierarchy of tasks through which cyber incidents are automatically processed without user inputs;
• retrieving a second structure for the cyber incident management system, wherein the second structure defines a second hierarchy of tasks through which cyber incidents are processed based on user inputs received in response to user queries generated for display on the user interface;
• comparing the incident characteristic to incident characteristics in a database of historical incidents to determine a shared structure node for transitioning from the first hierarchy of tasks to the second hierarchy of tasks at the shared structure node;
• generating an integrated structure by combining the first structure and the second structure at the shared structure node;
• processing the cyber incident through the integrated structure to the shared structure node;
• and
• generating for display, on the user interface, a user query comprising native data, for the cyber incident, and integration data that describes, in a human-readable format, a relationship of the native data to the integrated structure.