1. A method for implementing a response to one or more security incidents in a computing network, comprising: receiving, by a threat intelligence device of the computing network and from one or more data feed sources external to the computing network, information related to one or more previously identified computing network security threats; based at least in part on the information related to the one or more previously identified computing network security threats, determining, by the threat intelligence device, one or more observable indicators of compromise for at least one of the one or more previously identified computing network security threats; receiving, by a security information and analytics device of the computing network and from the threat intelligence device, the one or more observable indicators of compromise; continually monitoring, by the security information and analytics device, one or more computing network data sources internal to the computing network for occurrences of security incidents and identifying, by the security information and analytics device, a security incident as an occurrence of a particular computing network security threat from the one or more previously identified computing network security threats, based on detecting one or more of the one or more observable indicators of compromise for the particular computing network security threat; comparing, by the security and analytics device, the security incident with a predefined ontology that maps the security incident to one or more courses of action, the one or more courses of action including workflow steps to be performed in response to the security incident; selecting, by the security and analytics device, a response strategy that includes the one or more courses of action and providing, by the security and analytics device to an automated incident response device of the computing network, instructions for implementing the response strategy; and implementing, by the automated incident response device, the response strategy as an automated response including, for each workflow step of the one or more courses of action, performing the workflow step, receiving forensics information related to performing the workflow step from a host agent of the automated incident response device, and providing the forensics information to a forensics repository.