An improved technique involves providing a tool that connects standardized content bundles in order to carry out an arbitrarily complex investigation. An investigation server makes content bundles, which perform a standardized set of investigative actions based on a set of inputs, available to an investigation analyst. The investigation analyst selects particular content bundles based on a specified set of input parameters and a desired set of output parameters defining the investigation. The investigation analyst then connects the particular content bundles to form a single, complex workflow configured to produce the desired set of output parameters from the specified set of input parameters as a result of the investigation.