Generating security response recommendations

A system, comprising:

• a processor;
• and
• memory or storage comprising an algorithm or computer instructions, which when executed by the processor, performs an operation comprising:
• receiving scoring functions, a logical operator selection, a security graph, and external threat intelligence;
• generating a search pattern based on the scoring functions and the logical operator selection;
• evaluating the search pattern against a selected node of the security graph to identify a potential security threat represented by the security graph at the selected node;
• and
• generating a recommendation based on the evaluation and the external threat intelligence.

A computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code executable by one or more computer processors to perform an operation comprising:

• receiving scoring functions, a logical operator selection, a security graph, and external threat intelligence;
• generating a search pattern based on the scoring functions and the logical operator selection;
• evaluating the search pattern against a selected node of the security graph to identify a potential security threat represented by the security graph at the selected node;
• and
• generating a recommendation based on the evaluation and the external threat intelligence.