1. A method of operating an advisement system to provide default security actions in a computing environment, the method comprising: identifying a security incident for an asset in the computing environment; in response to identifying the security incident, identifying enrichment information about the security incident; determining a rule set for the security incident based on the enrichment information; identifying an action response for the security incident based on the rule set; and initiating implementation of the action response for the security incident in the computing environment.