1. A method for use in managing analysis of activity data, the method comprising: analyzing activity data for a security investigation by using a content bundle, wherein the content bundle specifies a set of actions, wherein the activity data is analyzed on a data analysis system based on the set of actions specified in the content bundle, wherein the set of actions indicates a workflow for performing the security investigation, wherein the activity data is gathered by an event management system, wherein the content bundle is managed by a security practitioner; performing the set of actions on the activity data based on a set of inputs provided to the content bundle, wherein performing each action of the set of actions includes invoking an operation on the data analysis system; and providing results of analysis of the activity data in a format based on a set of outputs configured for the content bundle.