Asynchronous incident response actions

Abstract

Techniques are described for asynchronous incident response actions. An example system includes a memory that stores instructions and one or more processors that execute the instructions to: process, with an event processing module, indications of events from a monitored system to generate an events data stream; transform, with an alert processing module and based on account settings data from an accounts settings data stream, events data from the events data stream into one or more alerts to generate at least a portion of an alerts data stream, the events data corresponding to an offset within the events data stream; map, with an incident mapping module and based on alerts data from the alerts data stream, the one or more alerts to an incident; and store, with the incident mapping module and to a storage device, an indication of the offset within the events data stream.