Abstract: Various computer systems and networks may benefit from an automated cyber threat mitigation coordinator. A related method can include receiving, at a server, data from at least one first sensor or tool. The data can be configured to inform the server of an actual or potential threat to at least one computer system or network. The method can also include processing, by the server, the data to determine at least one confirmation action to be taken with respect to the data. The method can further include performing, at the server, the determined confirmation action. The action can include communicating with at least one second sensor or tool. The method can additionally include receiving, at the server, a response to the communicating with the at least one second sensor or tool. The method can also include generating and outputting consolidated data to a user of the server, based on the response.

Abstract: Incident response systems may benefit from proper organization and handling of responses. For example, incident response systems may benefit from the pre-delegation of defined user roles for guiding one or more users in an incident response. A method can include monitoring, by a computer system, an incident. The method can also include determining, by the computer system, whether each of a plurality of incident response team members is checked in with respect to the incident. The method can further include maintaining, by the computer system, a set of task lists and role type assignments based on the determination.

Abstract: A system includes a server computer configured to host a plurality of web pages. A scanner is configured to scan the plurality of web pages to identify malicious links contained in the plurality of web pages. A proxy server is configured to filter the malicious links from content of the plurality of web pages served from the server computer to a user in response to a request from the user.