1. An information security auditing and incident investigation system comprising: a plurality of distributed audit and response tools, each of said tools having a coupling to a corresponding audit target in a computer communications network; a distributed audit and response tool manager communicatively linked to each of said distributed audit and response tools over said computer communications network; data extraction logic coupled to said distributed audit and response tool manager and configured to acquire information security audit data for corresponding audit targets via their respective audit and response tools; and, at least one correlation template programmed to group and define query sets for said information security audit data for a unified query across interrelated sets of said information security audit data.