code: protected Response findAppropriateResponse(Attack attack) {
  		DetectionPoint triggeringDetectionPoint = attack.getDetectionPoint();
  
  		SearchCriteria criteria = new SearchCriteria().
  				setUser(attack.getUser()).
  				setDetectionPoint(triggeringDetectionPoint).
  				setDetectionSystemIds(appSensorServer.getConfiguration().getRelatedDetectionSystems(attack.getDetectionSystem()));
  
  		//grab any existing responses
  		Collection<Response> existingResponses = appSensorServer.getResponseStore().findResponses(criteria);
  
  		String responseAction = null;
  		Interval interval = null;
  
  		Collection<Response> possibleResponses = findPossibleResponses(triggeringDetectionPoint);
  
  		if (existingResponses == null || existingResponses.size() == 0) {
  			//no responses yet, just grab first configured response from detection point
  			Response response = possibleResponses.iterator().next();
  
  			responseAction = response.getAction();
  			interval = response.getInterval();
  		} else {
  			for (Response configuredResponse : possibleResponses) {
  				responseAction = configuredResponse.getAction();
  				interval = configuredResponse.getInterval();
  
  				if (! isPreviousResponse(configuredResponse, existingResponses)) {
  					//if we find that this response doesn't already exist, use it
  					break;
  				}
  
  				//if we reach here, we will just use the last configured response (repeat last response)
  			}
  		}
  
  		if(responseAction == null) {
  			throw new IllegalArgumentException("No appropriate response was configured for this detection point: " + triggeringDetectionPoint.getLabel());
  		}
  
  		Response response = new Response();
  		response.setUser(attack.getUser());
  		response.setTimestamp(attack.getTimestamp());
  		response.setAction(responseAction);
  		response.setInterval(interval);
  		response.setDetectionSystem(attack.getDetectionSystem());
  
  		return response;
  	}
docs: Find/generate {@link Response} appropriate for specified {@link Attack}.
  
  @param attack {@link Attack} that is being analyzed
  @return {@link Response} to be executed for given {@link Attack}