1. A method for implementing a response to one or more security incidents in a computing network, comprising: identifying a security incident based on detecting one or more indicators of compromise associated with the security incident; comparing the security incident with a predefined ontology that maps the security incident to one or more courses of action; selecting a response strategy that includes one or more of the courses of action; and implementing the response strategy as an automated response.