Method and system for handling dynamic incidents

1. A method for handling dynamic incidents, comprising:

initiating, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

creating, by a first processor, at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

monitoring a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

detecting a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

storing information indicative of the first deviation event;

initiating, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

creating, by a second processor, at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

monitoring a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detecting a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

comparing the second deviation event to the first deviation event;

generating, based on the comparison, a suggestion comprising at least one modification to the second policy;

receiving an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

storing information indicative of the second deviation event.

2. The method of claim 1 , wherein each of the first deviation event and the second deviation event comprises an unexpected event.

3. The method of claim 1 , wherein the second deviation event is similar to the first deviation event.

4. The method of claim 1 , further comprising modifying the first policy based on the first deviation event.

5. The method of claim 1 , further comprising creating a third policy based on the first policy and the first deviation event.

6. The method of claim 1 , further comprising:

receiving a post incident assessment request;

presenting a user with the first plurality of events that occurred during the first incident; and

receiving a modification request indicating that the first policy is to be modified based on the first deviation event or that a third policy is to be created based on the first policy and the first deviation event.

7. A system for handling dynamic incidents, comprising:

a first processor operable to:

initiate, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident; and

create at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol; and

a first interface coupled to the processor, the first interface operable to:

monitor a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group; and

detect a first deviation event in the monitored first plurality of events, the first deviation event comprising an action not included in the first plurality of actions of the first policy;

the first processor is further operable to store information indicative of the deviation event;

a second processor operable to:

initiate, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident; and

create at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

a second interface coupled to the second processor, the second interface operable to:

monitor a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detect a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

compare the second deviation event to the first deviation event;

generate, based on the comparison, a suggestion comprising at least one modification to the second policy; and

receive an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion;

the second processor is further operable to store information indicative of the second deviation event.

8. The system of claim 7 , wherein each of the first deviation event and the second deviation event comprises an unexpected event.

9. The system of claim 7 , wherein the second deviation event is similar to the first deviation event.

10. The system of claim 7 , wherein the processor is further operable to modify the first policy based on the first deviation event.

11. The system of claim 7 , wherein the processor is further operable to create a third policy based on the first policy and the first deviation event.

12. The system of claim 7 , wherein the interface is further operable to:

receive a post incident assessment request;

present a user with the first plurality of events that occurred during the first incident; and

receive a modification request indicating that the first policy is to be modified based on the deviation event or that a third policy is to be created based on the first policy and the deviation event.

13. A non-transitory, computer readable medium comprising logic, the logic comprising code operable, when executed by a processor, to:

initiate, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

create at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

monitor a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

detect a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

store information indicative of the first deviation event;

initiate, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

create, by a second processor, at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

monitor a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the second policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

detect a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

compare the second deviation event to the first deviation event;

generate, based on the comparison, a suggestion comprising at least one modification to the second policy;

receive an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

store information indicative of the second deviation event.

14. The medium of claim 13 , wherein each of the first deviation event and the second deviation event comprises an unexpected event.

15. The medium of claim 13 , wherein the second deviation event is similar to the first deviation event.

16. The medium of claim 13 , wherein the code is further operable to modify the first policy based on the first deviation event.

17. The medium of claim 13 , wherein the code is further operable to create a third policy based on the first policy and the first deviation event.

18. The medium of claim 13 , wherein the code is further operable to:

receive a post incident assessment request;

present a user with the first plurality of events that occurred during the first incident; and

receive a modification request indicating that the first policy is to be modified based on the deviation event or that a third policy is to be created based on the first policy and the deviation event.

19. A system for handling dynamic incidents, comprising:

means for initiating, at a first time, a first policy in response to a first incident, the first policy comprising a first plurality of actions to be performed in response to the first incident;

means for creating at least a first virtual talk group comprising a first plurality of endpoints of different communication networks communicating using a first respective communication protocol;

means for monitoring a first plurality of events via a first plurality of sources, the first plurality of events including at least one of the first plurality of actions of the first policy, the first plurality of sources comprising an endpoint from the first plurality of endpoints of the first virtual talk group;

means for detecting a first deviation event in the monitored first plurality of events, the first deviation event comprising a first action not included in the first plurality of actions of the first policy;

means for storing information indicative of the first deviation event;

means for initiating, at a second time, a second policy in response to a second incident, the second policy comprising a second plurality of actions to be performed in response to the second incident;

means for creating at least a second virtual talk group comprising a second plurality of endpoints of different communication networks communicating using a second respective communication protocol;

means for monitoring a second plurality of events via a second plurality of sources, the second plurality of events including at least one of the second plurality of actions of the first policy, the second plurality of sources comprising an endpoint from the second plurality of endpoints of the second virtual talk group;

means for detecting a second deviation event in the monitored second plurality of events, the second deviation event comprising a second action not included in the second plurality of actions of the second policy;

means for comparing the second deviation event to the first deviation event;

means for generating, based on the comparison, a suggestion comprising at least one modification to the second policy;

means for receiving an indication in response to the suggestion, the indication indicating whether to modify the second policy in accordance with the suggestion; and

means for storing information indicative of the second deviation event.