1. A method for event-driven incident customizable automated workflows for incident remediation, comprising: monitoring activity in a network with an activity monitor implemented on a processor coupled to the network; collecting a plurality of events with the activity monitor, the plurality of events based on a violation of a security policy; filtering the collected plurality of events with the activity monitor based on pre-determined patterns defining events of interest to select filtered events, wherein the filtered events comprise single events of interest or running windows of events; analyzing the filtered events with a correlation analysis engine implemented on the processor; correlating two or more of the filtered events based on a set of correlation rules defining characteristics of one or more events that comprise an incident; detecting, with the correlation analysis engine, one or more incidents associated with the monitored activity based on the correlated two or more of the filtered events to identify one or more detected incidents; responsive to the detecting of the one or more incidents: assigning a workflow process instance to the one or more detected incidents, wherein the workflow process instance comprises a plurality of work-items including one or more system work-items that comprise one or more executable commands to be executed by one or more devices of the network, each system work-item directed to remediating the one or more incidents; creating an incident object instance associated with the one or more incidents, the incident object instance comprising a single, self-contained object containing the assigned workflow process instance including the one or more system work-items, one or more alert work-items, and aggregated incident details associated with the one or more incidents; storing the incident object instance in a data store; and electronically communicating, via the network to the one or more devices, the incident object instance to cause the one or more devices to automatically execute the workflow process instance including the one or more system work-items; initiating execution of the one or more executable commands of the one or more system work-items to perform one or more actions based on the workflow process instance of the incident object-instance, the one or more alert work-items to be automatically executed by the one or more devices of the network to send an alert as part of an audit trail; and receiving a set of one or more communications from the one or more devices consequent to the one or more alert work-items causing the one or more devices to generate alerts, where the set of one or more communications indicate a current status associated with the one or more system work-items, and, based on processing the set of one or more communications received, outputting for display information to graphically represent the current status associated with the one or more system work-items based on the workflow process instance of the incident object instance to track progress along a sequence in the workflow process instance to coordinate remediating the one or more incidents.