Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: Examples disclosed herein relate to using a card system framework. Some of the examples enable receiving, via a user interface, an indication that a first content item is requested about a first object; in response to the indication that the first content item is requested about the first object, presenting a first card on the user interface, the first card comprising a first content tile that describes a second object that is associated with the first content item; receiving, via the user interface, an indication that a second content item is requested about the second object; and in response to the indication that the second content item is requested about the second object, presenting a second card on the user interface, the second card comprising a second content tile that describes a third object that is associated with the second content item.

Abstract: Examples disclosed herein relate to security investigations using a card system framework. Some of the examples enable presenting a first card on a user interface, the first card comprising a first content tile that describes a first security alert object that is associated with a first plurality of content items, the first plurality of content items comprising at least one of: a source host identifier, an Internet Protocol (IP) address, a severity level, a confidence level, an alert status, a user identifier, an alert type, an attack stage, a port, a protocol, and a geographical location; and in response to an indication that a first content item among the first plurality of content item is requested about the first security alert object, presenting a second card on the user interface, the second card comprising a second content tile that describes a second entity object that is associated with a second plurality of content items.

Abstract: Examples disclosed herein relate to playbook-based security investigations using a card system framework. Some of the examples enable receiving an indication that a playbook is selected for investigating a security alert object, the playbook comprising a plurality of cards, wherein a first object definition associated with the security alert object comprises a parameter, and wherein the playbook inherits a value of the parameter from the first object definition; causing a first card from the playbook to be displayed on a user interface, the first card comprising a first content tile that describes the security alert object; and causing a second card from the playbook to be displayed on the user interface, the second card comprising a second content tile that describes a second object, wherein a second object definition associated with the second object comprises the parameter inherited from the first object definition.

Abstract: A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

Abstract: A method and a search engine are described. A unique key is received. A hash is searched for a match to the unique key. Concurrently with searching the hash, a cache is searched for the match to the unique key. And information regarding the unique key is obtained.