1. A method of constructing an electronic tool for performing an investigation into unusual activity in a computer network, the investigation being defined by a specified set of input parameters and a set of output parameters specified by an investigator, the method comprising: providing, by an investigation server, a set of content bundles to the investigator, each content bundle performing a respective set of actions including at least one of (i) an electronic access operation on data external to the investigation server and (ii) an electronic data transformation operation, the respective set of actions being based on a set of inputs and providing a set of outputs upon performing the respective set of actions, the set of inputs including identifiers of entities interacting with the computer network; selecting, by the investigation server under control of the investigator, a subset of the set of content bundles based on the specified set of input parameters and the set of output parameters specified by the investigator defining the investigation; and connecting, by the investigation server under control of the investigator, the content bundles of the subset of the set of content bundles to form, as the electronic tool, a single, complex workflow configured to produce the set of output parameters specified by the investigator from the specified set of input parameters, thereby enabling the investigator to carry out the investigation.