Playbook-based security investigations using a card system framework

The method for enabling playbook-based security investigations using a card system framework, the method comprising:

• receiving an indication that a first playbook is selected for investigating a first security alert object, the first playbook comprising a first plurality of cards, wherein a first object definition associated with the first security alert object comprises a parameter, and wherein the first playbook inherits a value of the parameter from the first object definition;
• causing a first card from the first playbook to be displayed on a user interface, the first card comprising a first content tile that describes the first security alert object;
• and
• causing a second card from the first playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

A system for enabling playbook-based security investigations using a card system framework, the system comprising a hardware processor that executes machine-readable instructions that cause the system to:

• receive an indication that a first playbook is selected for investigating a first security alert object, the first playbook comprising a first plurality of cards, wherein a first object definition associated with the first security alert object comprises a parameter, and wherein the first playbook inherits a value of the parameter from the first object definition;
• cause a first card from a first playbook to be displayed on a user interface, the first card comprising a first content tile that describes the first security alert object;
• and
• cause a second card from the first playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition;
• and
• cause a playbook conclusion card to be displayed on the user interface.