1. A method for managing a network security incident comprising at least one underlying security event, the method comprising: receiving a first set of data associated with the event; identifying based at least in part on said first set of data an initial group including a first set of one or more recommended responsive actions to be taken in response to the event; receiving a second set of data associated with the event; and updating, via one or more computer processors, said initial group of one or more recommended responsive actions to include a second set of one or more recommended responsive actions based at least in part on said second set of data associated with the event.