1. A computer implemented method for event driven incident response including one or more workflow process instances for handling incident response, each having one or more work-items, the method comprising: monitoring network activity for one or more network events; identifying occurrence of one or more incidents based on the one or more network events; associating at least one workflow process instance to an identified incident based at least in part on incident details; determining the work-items to perform based on the workflow process instance, wherein the work-items include one or more user work-items and system work-items; automatically implementing the one or more system work-item; notifying a user to complete one or more user work-item; and tracking progress of the incident's workflow process instance based on output from the work-items.