1. A computer-implemented method for using event-correlation graphs to generate remediation procedures, at least a portion of the method being performed by at least one computing device comprising at least one processor, the method comprising: detecting, by the at least one computing device, a suspicious event involving a first actor within a computing system, wherein the suspicious event could not be individually classified as definitively malicious; constructing, by the at least one computing device in response to detecting the suspicious event involving the first actor, an event-correlation graph, wherein: the event-correlation graph comprises at least: a first node that represents the first actor; a second node that represents a second actor; and an edge that interconnects the first node and the second node and represents an additional suspicious event involving the first actor and the second actor; each suspicious event represented in the event-correlation graph could not be individually classified as definitively malicious; calculating, by the at least one computing device based at least in part on the additional suspicious event involving the first actor and the second actor, an attack score for the event-correlation graph; determining that the attack score is greater than a predetermined threshold; determining, based at least in part on the attack score being greater than the predetermined threshold, that the suspicious event comprises an attack on the computing system; using the event-correlation graph to generate a procedure for remediating an effect of the attack on the computing system.