1. A method for managing an intrusion on a computer, the method comprising: graphically representing an intrusion path of a known intrusion, the graphical representation including a scripted response at a node in the intrusion path; matching a current intrusion of the computer to the graphical representation of the known intrusion according to at least one common feature in the intrusion path of the known intrusion and the current intrusion; and responsive to the matching of the known intrusion and the current intrusion, initiating the scripted response, which is capable of responding to the current intrusion.