Information security auditing and incident investigation system

An information security auditing and incident investigation method comprising the steps of:

• distributing a plurality of distributed audit and response tools to each of a plurality of audit targets in an enterprise system;
• reading a correlation template to query different audit targets via their respective audit and response tools, so as to provide a complete result set for said query across said different audit targets;
• communicating with selected ones of said audit targets upon said correlation template to acquire said information security audit data from each of said audit targets via their respective audit and response tools;
• and
• receiving information security audit data provided in response to said query;
• and,
• rendering said information security audit data to produce an audit report.

A computer program product comprising a computer storage medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

• distributing a plurality of distributed audit and response tools to each of a plurality of audit targets in an enterprise system;
• reading a correlation template to query different audit targets via their respective audit and response tools, so as to provide a complete result set for said query across said different audit targets;
• communicating with selected ones of said audit targets, via their respective audit and response tools, upon said correlation template to recursively acquire information security audit data for said audit targets via their respective audit and response tools;
• and,
• rendering results from said query to produce an audit report.