Playbook-based security investigations using a card system framework

1. A non-transitory machine-readable storage medium comprising instructions executable by a hardware processor for enabling playbook-based security investigations using a card system framework, the machine-readable storage medium comprising:

instructions to present a first card from a first playbook on a user interface, the first playbook comprising a first plurality of cards, the first card comprising a first content tile that describes a first security alert object, and a first question pertaining to the first security alert object;

instructions to receive, via the user interface, a first answer to the first question;

instructions to present a second card from the first playbook on the user interface, the second card comprising a second content tile that describes a second object, and a second question pertaining to the second object;

instructions to receive, via the user interface, a second answer to the second question; and

instructions to present a playbook conclusion card based on the first and second answers, wherein the playbook conclusion card prompts a user to indicate a degree of accuracy of the first security alert object.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the first content tile comprises information about a particular security alert, including at least one of: a destination Internet Protocol (IP) address, a source host identifier, a logon type, and a count.

3. The non-transitory machine-readable storage medium of claim 2 , wherein the second content tile comprises information about alerts that are adjacent to the particular security alert, including at least one of: an alert identifier, a start time, an end time, an attack stage, a confidence level, a severity level, and an alert status.

4. The non-transitory machine-readable storage medium of claim 3 , comprising:

instructions to present a third card from the first playbook on the user interface, the third card comprising a third content tile that comprises forensic data.

5. The non-transitory machine-readable storage medium of claim 1 , wherein the first and second cards appear stacked on top of each other on the user interface.

6. The non-transitory machine-readable storage medium of claim 1 , the instructions to present the second card from the first playbook on the user interface comprise:

instructions to select the second card from the first plurality of cards based on the first answer.

7. The non-transitory machine-readable storage medium of claim 1 , comprising:

instructions to present a third content tile as part of the first card, the third content tile providing additional information to help a user to answer the first question.

8. The non-transitory machine-readable storage medium of claim 1 , wherein a plurality of playbooks are associated with the first security alert object, comprising:

instructions to receive, via the user interface, an indication that a second playbook among the plurality of playbooks is requested;

instructions to present a third card from second playbook on the user interface, the second playbook comprising a second plurality of cards, the third card comprising a third content tile that describes the first security alert object, a third question pertaining to the first security alert object.

9. The non-transitory machine-readable storage medium of claim 1 , wherein the playbook conclusion card prompts the user to indicate whether a playbook-based security investigation should be continued by another user.

10. The non-transitory machine-readable storage medium of claim 9 , comprising:

in response to an indication that the playbook-based security investigation should be continued by the another user, instructions to allow the another user to access the playbook-based security investigation, wherein the access comprises at least one of: an access to edit, an access to view, and an access to create a duplicate card or investigation.

11. The non-transitory machine-readable storage medium of claim 1 , wherein the playbook conclusion card comprises a summary of answers to a plurality of questions associated with the first playbook.

12. The non-transitory machine-readable storage medium of claim 1 , wherein an object definition associated with the first security alert object comprises a parameter, and wherein the first playbook inherits a value of the parameter from the object definition.

13. A method for enabling playbook-based security investigations using a non-transitory computer-readable storage medium comprising instructions executable by a processor of a card system framework, the method comprising:

receiving, via the processor, an indication that a first playbook is selected for investigating a first security alert object, the first playbook comprising a first plurality of cards, wherein a first object definition associated with the first security alert object comprises a parameter, and wherein the first playbook inherits a value of the parameter from the first object definition;

causing, via the processor, a first card from the first playbook to be displayed on a user interface, the first card comprising a first content tile that describes the first security alert object; and

causing, via the processor, a second card from the first playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

14. The method of claim 13 , wherein the parameter comprises at least one of: (i) a timeframe within which timestamps of content items to be retrieved for the first plurality of cards should be, (ii) an object or user identifier, (iii) a status, and (iv) category.

15. The method of claim 13 , comprising:

determining a plurality of playbooks to be recommended based on characteristics of the first security alert object, the plurality of playbooks including the first playbook.

16. The method of claim 15 , comprising:

receiving an indication that a second playbook is selected from the plurality of playbooks for investigating the first security alert object, the second playbook comprising a second plurality of cards, wherein the second playbook inherits a value of the parameter from the first object definition.

17. The method of claim 13 , wherein the first security alert object is associated with at least one of: a source host identifier and an Internet Protocol (IP) address.

18. A system for enabling playbook-based security investigations using a card system framework, the system comprising a hardware processor that executes machine-readable instructions that cause the system to:

receive an indication that a first playbook is selected for investigating a first security alert object, the first playbook comprising a first plurality of cards, wherein a first object definition associated with the first security alert object comprises a parameter, and wherein the first playbook inherits a value of the parameter from the first object definition;

cause a first card from a first playbook to be displayed on a user interface, the first card comprising a first content tile that describes the first security alert object;

cause a second card from the first playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition; and

cause a playbook conclusion card to be displayed on the user interface.

19. The system of claim 18 , the system comprising the hardware processor that executes the machine-readable instructions that cause the system to:

generate the second content tile based on the parameter.

20. The system of claim 18 , the system comprising the hardware processor that executes the machine-readable instructions that cause the system to:

retrieve a plurality of content items for the second card based on the parameter; and

generate the second content tile with the plurality of content items.

21. The system of claim 18 , the system comprising the hardware processor that executes the machine-readable instructions that cause the system to:

generate the first playbook based on an existing security investigation.