Abstract: A system may select a list of servers in a computer network to perform behavioural profiling, wherein each server is associated with a domain name, the list of servers includes domain name entries, and the list of servers is prioritized according to a popularity value for each server. The system may update the list of servers based on a popularity threshold, partition the computer network into one of: subnetworks or subdomains, and establish a hierarchy along one of: the subnetworks or the subdomains based on the domain name entries in the list of servers. The system may update the popularity value for a server associated with a resolved network address, and may update the hierarchy along one of: the subnetworks or the subdomains based on the popularity value.

Abstract: In one example in accordance with the present disclosure, a method for schedule creation may include interpreting a set of temporal constraints corresponding to a predetermined time period for a user. The set of temporal constraints may include a constraint defining a minimum period of uninterrupted time for a primary job responsibility of the user. The method may also include generating a set of blocks based on the set of temporal constraints. Each block in the set of blocks corresponds to an event to be scheduled during the predetermined time period and each block has a weight. The method may also include creating a schedule including each block in the set of blocks. The schedule may include the minimum period of uninterrupted time for a primary job responsibility of the user.

Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: A system may select a list of servers in a computer network to perform behavioural profiling, wherein each server is associated with a domain name, the list of servers includes domain name entries, and the list of servers is prioritized according to a popularity value for each server. The system may update the list of servers based on a popularity threshold, partition the computer network into one of: subnetworks or subdomains, and establish a hierarchy along one of: the subnetworks or the subdomains based on the domain name entries in the list of servers. The system may update the popularity value for a server associated with a resolved network address, and may update the hierarchy along one of: the subnetworks or the subdomains based on the popularity value.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: In one example in accordance with the present disclosure, a method for schedule creation may include interpreting a set of temporal constraints corresponding to a predetermined time period for a user. The set of temporal constraints may include a constraint defining a minimum period of uninterrupted time for a primary job responsibility of the user. The method may also include generating a set of blocks based on the set of temporal constraints. Each block in the set of blocks corresponds to an event to be scheduled during the predetermined time period and each block has a weight. The method may also include creating a schedule including each block in the set of blocks. The schedule may include the minimum period of uninterrupted time for a primary job responsibility of the user.

Abstract: Example implementations relate to recorded user actions. For example, user actions in a plurality of different environments are recorded, and a user-activatable element is associated with the recorded user actions. The user-activatable element is caused to be presented.