{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,30]],"date-time":"2026-08-30T01:34:31Z","timestamp":1788053671328,"version":"build-2784847793"},"publisher-location":"New York, NY, USA","reference-count":26,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,8,29]],"date-time":"2023-08-29T00:00:00Z","timestamp":1693267200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,8,29]]},"DOI":"10.1145\/3600160.3605066","type":"proceedings-article","created":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T22:54:41Z","timestamp":1691621681000},"page":"1-9","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Automatic incident response solutions: a review of proposed solutions\u2019 input and output"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-4394-7695","authenticated-orcid":false,"given":"Henrik","family":"Karlzen","sequence":"first","affiliation":[{"name":"Swedish Defence Research Agency (FOI), Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2606-4139","authenticated-orcid":false,"given":"Teodor","family":"Sommestad","sequence":"additional","affiliation":[{"name":"Swedish Defence Research Agency (FOI), Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,8,29]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2010.5588654"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.3390\/a10020039"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102984"},{"key":"e_1_3_2_1_4_1","unstructured":"CACAO Security Playbooks Version 1.0: https:\/\/docs.oasis-open.org\/cacao\/security-playbooks\/v1.0\/cs01\/security-playbooks-v1.0-cs01.html. Accessed: 2023-05-11."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/CyberSA.2017.8073399"},{"key":"e_1_3_2_1_6_1","unstructured":"Grance T. 2008. Computer Security Incident Handling Guide (SP 800-61)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSR51186.2021.9527957"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Hus\u00e1k M. and Cermak M. 2022. SoK: Applications and Challenges of using Recommender Systems in Cybersecurity Incident Handling and Response. Association for Computing Machinery.","DOI":"10.1145\/3538969.3538981"},{"key":"e_1_3_2_1_9_1","unstructured":"InsightConnect Workflows: 2023. https:\/\/github.com\/rapid7\/insightconnect-workflows. Accessed: 2023-05-29."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSSP.2019.00017"},{"key":"e_1_3_2_1_11_1","unstructured":"Kaloroumakis P.E. and Smith M.J. 2021. Toward a Knowledge Graph of Cybersecurity Countermeasures. (2021)."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00607-016-0495-8"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.32604\/iasc.2021.016240"},{"key":"e_1_3_2_1_14_1","unstructured":"Kitchenham B. 2004. Procedures for performing systematic reviews. Citeseer."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3168976"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101999"},{"key":"e_1_3_2_1_17_1","unstructured":"Microsoft Sentinel and Microsoft 365 Defender: 2023. https:\/\/github.com\/Azure\/Azure-Sentinel\/tree\/master\/Playbooks. Accessed: 2023-05-29."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2005.09.006"},{"key":"e_1_3_2_1_19_1","unstructured":"Navarro J. A Systematic Survey on Multi-step Attack Detection."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2015.03.007"},{"key":"e_1_3_2_1_21_1","unstructured":"Phantom Community Playbooks: 2023. https:\/\/github.com\/phantomcyber\/playbooks. Accessed: 2023-05-29."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2017.4541054"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","unstructured":"Piedrahita A.F.M. 2018. Virtual incident response functions in control systems. Computer Networks. 135 (2018) 147\u2013159. DOI:https:\/\/doi.org\/10.1016\/j.comnet.2018.01.040.","DOI":"10.1016\/j.comnet.2018.01.040"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2021.3117338"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"crossref","unstructured":"Sommestad T. and Hallberg J. 2012. Cyber security exercises and competitions as a platform for cyber security experiments.","DOI":"10.1007\/978-3-642-34210-3_4"},{"key":"e_1_3_2_1_26_1","unstructured":"ThreatConnect Playbooks: 2023. https:\/\/github.com\/ThreatConnect-Inc\/threatconnect-playbooks\/tree\/master\/playbooks. Accessed: 2023-05-29."}],"event":{"name":"ARES 2023: The 18th International Conference on Availability, Reliability and Security","location":"Benevento Italy","acronym":"ARES 2023"},"container-title":["Proceedings of the 18th International Conference on Availability, Reliability and Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605066","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3600160.3605066","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:49:16Z","timestamp":1750182556000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3600160.3605066"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,29]]},"references-count":26,"alternative-id":["10.1145\/3600160.3605066","10.1145\/3600160"],"URL":"https:\/\/doi.org\/10.1145\/3600160.3605066","relation":{},"subject":[],"published":{"date-parts":[[2023,8,29]]},"assertion":[{"value":"2023-08-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}