Novel techniques are described for automated crisis incident response in facilities having networks of Internet of Things (IoT devices). For example, embodiments can operate in context of automatically responding to an active shooter incident in a school. Detection of a gunshot event can trigger embodiments automatically to obtain (e.g., retrieve and/or compute) and execute an automated response plan. Execution of the plan can involve automated control of multiple IoT devices installed in and around the facility, and can be responsive to feedback from the IoT devices. Some embodiments facilitate interaction with crisis responders via a responder network, providing such responders with various levels of information access and/or control of components (e.g., execution of the automated response plan can also be responsive to commands issued by responders.