1. A computer-implemented method, comprising: receiving, by a threat intelligence device within a computing network and from one or more data sources external to a computing network, security threat information related to one or more computing network security threats; based at least in part on the security threat information, identifying one or more indicators of compromise for at least one of the computing network security threats; monitoring, by a security information and analytics device of the computing network, one or more computing network data sources internal to the computing network for occurrences of security incidents; and determining, by the security information and analytics device, that a security incident is an occurrence of a particular computing network security threat of the one or more computing network security threats, comprising: for each indicator of compromise for the particular computing network security threat: (i) determining that one or more actions that are associated with the indicator of compromise have been performed within the computing network; (ii) determining a credibility score of each of the actions that has been performed within the computing network; (iii) determining a composite credibility score of the indicator of compromise, by combining the determined credibility scores of each of the performed actions; and (iv) determining whether the indicator of compromise indicates an actual computing network security threat, based on the composite credibility score; and in response to determining that at least one indicator of compromise indicates an actual computing network security threat, based on the composite credibility score: providing incident information related to the security incident; receiving a selection of at least one course of action for responding to the actual computing network security threat; and implementing, by an incident response orchestration device of the computing network, the selected at least one course of action, including coordinating performance of one or more steps of the selected at least one course of action and receiving forensics information related to performance of the one or more steps.