The `incident_response` queries originate from the upstream osquery project:
<https://github.com/osquery/osquery/blob/master/packs/incident-response.conf>
Additional tables have been added and the intervals have been modified.