Most security incident teams work in close real-time communication with each other to ensure that related incidents are grouped together and handled with consistent defensive actions. As the size of the internet has grown and the tactics of attackers has shifted, it is not always obvious what security incidents or events are related to each other. Today's security teams now need to connect security activity that is sometimes months apart, on different partner networks, or across different attacking infrastructure. Additionally, the teams face issues of employee departures, work handoffs, outsourcing, cross border communications, and budget constraints. It is not always practical or even possible to maintain real-time communication with all relevant partner teams. Our team has been working in collaboration with US-CERT on a variety of automated methods to measure the similarity between incident reports. Measurements can be used to supplement the knowledge that a real-time operations team already has, or it can be helpful in identifying unknown historical information in a large corpus. For example, in one incident ticket collection database, we examine how to quickly locate the most-closely related historical incidents based upon analyst settings for what they consider to be most important in determining similarity. We also consider identifying and presenting data-driven taxonomies of cyber-attacks based on grouping similar incidents into clusters regardless of human categorical labels which are often under-specified. Finally, we are developing novel ways to take large sets of cyber-attack warnings and compare them against attacks that are actually observed to decide whether any of the warnings had merit. Our presentation will review multiple approaches to computing similarity of incident reports at multiple levels. One approach involves viewing each incident report as a document containing many terms and analyzing the graph of incidents with linkages determined by shared terms. Another approach involves defining similarities for each kind of detail in an incident and then averaging the similarities across the various details between any pair of incidents. Finally, we'll introduce a new generalization of the Jaccard similarity to account for approximate equality between set elements and demonstrate how this could be used to detect similarity between incidents containing sets of indicators among which exact matches are rare and yet approximate matches are meaningful.