Kim Hammer's thesis on Automated Intrusion Response might be interesting study material. See the talk from CDIS spring conference 2024.