Auto change incident status based on membership of a sender pattern list?

There is a subset of individuals being monitored that we want to automatically change the incident status to a specific predefined value as soon as their endpoint incidents or network incidents are detected.  How can we do that?