Abstract: The invention includes a computerized method for interfacing with a security hardware appliance for assessing potential remedial action in response to a potential information security threat by automatically ingesting and parsing incoming alerts from a security hardware appliance, automatically extracting relevant data elements from the alert, using the extracted information to supplement the alert by querying and retrieving from other systems, and automatically ranking the alerts in terms of importance using an engine that combines information, and issuing a command to take remedial, containment, or other programmed action on the alerts automatically.