1. An information security auditing and incident investigation system comprising: a plurality of distributed audit and response tools, each of said tools having a coupling to a corresponding audit target in a computer communications network; a distributed audit and response tool manager communicatively linked to each of said distributed audit and response tools over said computer communications network; data extraction logic coupled to said distributed audit and response tool manager and configured to acquire audit data for corresponding audit targets in said computer communications network; and, at least one correlation template programmed to group and define query sets for said audit data for a unified query across interrelated sets of said audit data.