1. A computer-implemented method, comprising: receiving, by a threat intelligence device within a computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats; based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats; receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise; monitoring, by the security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular security threat to the computing network from the one or more previously identified computing network security threats, based on detecting one or more observable indicators of compromise for the particular security threat; comparing, by the security information and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, each of the one or more courses of action including workflow steps to be performed in response to the security incident; providing, through an operator display interface, a notification of the security incident, wherein the notification includes a list of the one or more courses of action that are mapped to the security incident; receiving, through the operator display interface, a selection of one or more of the one or more courses of action; and implementing, by an automated incident response device, the selected one or more courses of action including, for each workflow step of the selected one or more courses of action, performing the workflow step and receiving forensics information related to performing the workflow step.