The campus network is the birthplace of a large number of attacks, and also the attacker's objective that is most easily broken. How to build up an effective technical system to support emergency response under the current state of lower invests in maintaining the campus network Yecurity is an issue worth studying. An emergency response log has been designed to record each emergency incident response process. The role of the log is more and more important with an increasing accumulation of information. With the log, engineers can determine the type of many non-deterministic emergency incidents grouped into deterministic events, in order to improve the system reliability of emergency response.