TECHNICAL BACKGROUND

Information technology (IT) environments often employ various computing components, both physical and virtual, to provide desired operations. These computing elements may include end user computing devices, host computing devices, virtual machines, switches, routers, firewalls, and the like. To maintain efficient and effective operations of the IT environment, incident response services may be employed that can respond to various incidents within the IT environment. These incidents may include or be associated with viruses, malware, spyware, denial of service attacks, phishing attacks, server crashes, device failures, power outages, unknown communications, or some other similar incident.

However, while incident response services provide response operations to incidents within the IT environment, difficulties arise as the size and complexity of the IT environment increases. These difficulties are often compounded when the new computing components provide different operations and are configured with varying hardware and software configurations. Further, the increasing number computing components in combination with limited administrative personnel and resources can make it difficult to manage the investigation and remediation of incidents in the environment. Even with ample administrators or analyst users, it can be cumbersome to coordinate the investigation and remediation efforts.

SUMMARY

Described herein are improvements for incident response in an information technology (IT) environment. In one example, an incident service can identify an incident in the IT environment and determine other incidents that share traits with the identified incident. Once the other incidents are identified, the incident service can aggregate data associated with the incident with data for the other incidents and generate a summary based on the aggregated data. In some implementations, the summary may be used to efficiently combine incident data for multiple incidents, permitting efficient response to multiple incidents in the IT environment.

