Efficient incident response through tree-based visualizations of hierarchical clustering

1. A computer-implemented method comprising:

storing, at a database at a computing device, a plurality of historical incident records, a historical incident record representing an instance of a potential security incident at a particular computer system and including an encoded incident type;

clustering, by an automated engine of the computing device, the plurality of historical incident records into a plurality of nodes based on characteristics of the plurality of historical incident records and arranging the nodes into a hierarchical tree, each of the nodes of the hierarchical tree being clustered based on the encoded incident types, the automated engine determining which of the plurality of historical incident records to publish within the plurality of nodes based on machine learned rules and highlighting any of the nodes of the plurality of nodes that satisfy a threshold of published historical incident records;

presenting at least a subsection of the hierarchical tree in a graphical user interface configured to allow a user to select particular nodes in the hierarchical tree for additional information;

receiving a user selection of a first node in the hierarchical tree, the first node having an associated level of granularity;

identifying a current security incident;

identifying an incident type of the current security incident;

identifying related historical incident records based on the encoded incident type from the plurality of historical incident records included in the first node in the hierarchical tree, the related historical incident records being sufficiently similar to the current security incident based on the incident type;

generating a first suggested response to the current security incident by automatically identifying previous actions from the related historical incident records, the previous actions being taken in response to instances of the potential security incidents related to the current security incident that occur with a threshold degree of frequency among the historical incident records in the first node of the hierarchical tree; and

presenting the first suggested response to the current security incident in a graphical user interface.

2. The computer-implemented method of claim 1 , wherein the plurality of historical incident records includes the plurality of historical incident records and one or more current security incident records, the one or more current security incident records comprising the current security incident.

3. The computer-implemented method of claim 2 , further comprising:

receiving a user-selected action, the action selected in response to the current security incident; and

performing the user-selected action.

4. The computer-implemented method of claim 3 , further comprising:

evaluating the performed user-selected action to determine whether the current security incident is resolved.

5. The computer-implemented method of claim 3 , further comprising:

adding the current security incident to the plurality of historical incident records for future clustering.

6. The computer-implemented method of claim 1 , further comprising:

prior to clustering the plurality of historical incident records:

accessing the current security incident from an incident queue; and

selecting one or more historical incident records from the plurality of historical incident records based on the accessed current security incident to cluster while generating the hierarchical tree.

7. The computer-implemented method of claim 1 , wherein historical incident records include a completed response record.

8. The computer-implemented method of claim 7 , wherein generating the first suggested response to the current incident record further comprises:

analyzing one or more historical incident records associated with a node selected by a user;

identifying, from the one or more incident records, one or more completed actions for the one or more historical incident records; and

selecting a completed action from the one or more identified completed actions.

9. The computer-implemented method of claim 8 , wherein the completed action is selected from the one or more completed actions based on the frequency with which actions were selected in the historical incident records associated with a node selected by the user.

10. The computer-implemented method of claim 8 , wherein the completed action is selected from the one or more identified completed actions based on a success rate of the completed actions.

11. The computer-implemented method of claim 1 , further comprising:

while presenting the hierarchical tree in the graphical user interface, presenting, adjacent to the hierarchical tree, a grid-based information display structure; and

in response to receiving user selection of the first node, presenting additional information associated with the historical incident records included with the first node in the grid-based information display structure.

12. The computer-implemented method of claim 1 , further comprising:

responsive to user selection of a first node in the hierarchical tree, updating the hierarchical tree presented in the graphical user interface to display a first child node of the first node and a second child node of the first node, the first child node and the second child node having an associated level of granularity different from the first node.

13. The computer implemented method of claim 12 , further comprising:

receiving a user selection of the first child node; and

generating a second suggested response based on the incident records included in the first child node, wherein the second suggested response is different than the first suggested response.

14. The computer implemented method of claim 1 , wherein the shape, color, size, and boldness used to display a node in the graphical user interface is associated with at least one attribute of the node.

15. At least one non-transitory computer readable-storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to execute the following steps:

storing, at a database at a computing device, a plurality of historical incident records, a historical incident record representing an instance of a potential security incident at a particular computer system and including an encoded incident type;

clustering, by an automated engine of the computing device, the plurality of historical incident records into a plurality of nodes based on characteristics of the plurality of historical incident records and arranging the nodes into a hierarchical tree, each of the nodes of the hierarchical tree being clustered based on the encoded incident types, the automated engine determining which of the plurality of historical incident records to publish within the plurality of nodes based on machine learned rules and highlighting any of the nodes of the plurality of nodes that satisfy a threshold of published historical incident records;

presenting at least a subsection of the hierarchical tree in a graphical user interface configured to allow a user to select particular nodes in the hierarchical tree for additional information;

receiving a user selection of a first node in the hierarchical tree, the first node having an associated level of granularity;

identifying a current security incident;

identifying an incident type of the current security incident;

identifying related historical security incident records based on the encoded incident type from the plurality of historical incident records included in the first node in the hierarchical tree, the related historical incident records being sufficiently similar to the current security incident based on the incident type;

generating a first suggested response to the current security incident by automatically identifying previous actions from the related historical incident records, the previous actions being taken in response to instances of the potential security incidents related to the current security incident that occur with a threshold degree of frequency among the historical incident records in the first node of the hierarchical tree; and

presenting the first suggested response to the current security incident in a graphical user interface.

16. The non-transitory computer readable-storage medium of claim 15 , wherein the plurality of historical incident records includes the plurality of historical incident records and one or more current security incident records, the one or more current security incident records comprising the current security incident.

17. The non-transitory computer readable-storage medium of claim 16 further storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to execute the following steps:

receiving a user-selected action, the action selected in response to the current security incident; and

performing the user-selected action.

18. A computer system comprising:

system memory;

a storage module residing in system memory, the storage module being programmed to store, at a database at a computing device, a plurality of historical incident records, a historical incident record representing an instance of a potential security incident at a particular computer system and including an encoded incident type;

a clustering module residing in system memory, the clustering module being programmed to use an automated engine to cluster the plurality of historical incident records into a plurality of nodes based on characteristics of the plurality of historical incident records and arranging the nodes into a hierarchical tree, each of the nodes of the hierarchical tree being clustered based on the encoded incident types, the automated engine determining which of the plurality of historical incident records to publish within the plurality of nodes based on machine learned rules and highlighting any of the nodes of the plurality of nodes that satisfy a threshold of published historical incident records;

a presentation module residing in system memory, the presentation module being programmed to present at least a subsection of the hierarchical tree in a graphical user interface configured to allow a user to select particular nodes in the hierarchical tree for additional information;

a reception module residing in system memory, the reception module being programmed to receive a user selection of a first node in the hierarchical tree, the first node having an associated level of granularity;

a generation module residing in system memory, the generation module being programmed to identify a current security incident, identify an incident type of the current security incident, identify related historical incident records based on the encoded incident type from the plurality of historical incident records included in the first node in the hierarchical tree, the related historical incident records being sufficiently similar to the current security incident based on the incident type, and generate a first suggested response to the current security incident by automatically identifying previous actions from the related historical incident records, wherein the previous actions being taken in response to instances of the potential security incidents related to the current security incident that occur with a threshold degree of frequency among the historical incident records in the first node of the hierarchical tree;

a suggestion module residing in system memory, the suggestion module being programmed to present the first suggested response to the current security incident in a graphical user interface; and

at least one processor configured to execute the modules.

19. The computer system of claim 18 , wherein the plurality of historical incident records includes the plurality of historical incident records and one or more current security incident records, the one or more current security incident records comprising the current security incident.

20. The computer system of claim 19 , further comprising:

an action reception module residing in system memory, the action reception module being programmed to receive a user-selected action, the action selected in response to the current security incident; and

performing the user-selected action.