Unfortunately, I do not think something like this exists without a significant cost attached (commercial platforms).
There are platforms from certain companies than dig much deeper into processes, baselines, etc. that can pull some low hanging IOCs, but even those will require human intervention.
Incident Response is a collection of steps taken to determine if a system was impacted, how bad it was impacted, and what all access the attackers obtained, files touched, etc.
This means, that IR is highly ad-hoc based on the situation. There can be similarities between responses, but ultimately the alert that led you to investigate will result in a different response to each system (unless a situation occurs like: the attack hit multiple targets with the same exploits/malware and you're doing clean up on each system [and even this has caveats]).
Ultimately, what you are looking for isn't really feasible from an open source solution at this time. IR is highly ad-hoc based on the indicators, malware, exploits, IDS/system level alerts that triggered, etc.