Splunk · consulting-deck
2023 conf SEC1096C
52 pages · 4 arc beats · 2 loops
2023 conf SEC1096C
Splunk arc beats above · slides in the middle · loops below · scroll → 2 LOOPS
1246810121416182022242628303234363840424446485052
Deck intelligence map
4 coverage by narrative range · generated from this deck JSON
Narrative range 52 total
Metadata
Components
Metrics
Tools
Frameworks
Beats
Loops
Situation & Context 6 slides 100% 6/6 slides 100% 6/6 slides · 24 hits — 0/6 slides
— 0/6 slides
— 0/6 slides
100% 6/6 slides — 0/6 slides
Problem & Complication 8 slides 100% 8/8 slides 100% 8/8 slides · 31 hits — 0/8 slides
75% 6/8 slides · 7 hits — 0/8 slides
100% 8/8 slides 37.5% 3/8 slides Solution & Approach 16 slides 100% 16/16 slides 100% 16/16 slides · 85 hits — 0/16 slides
75% 12/16 slides 12.5% 2/16 slides 100% 16/16 slides 25% 4/16 slides Impact & Next Steps 22 slides 100% 22/22 slides 100% 22/22 slides · 95 hits — 0/22 slides
31.8% 7/22 slides 18.2% 4/22 slides 100% 22/22 slides — 0/22 slides
Slide inventory
52 every slide · same image gating as the playbook
02
Includes speaker name, title, company, and session code.front_matter
Open slide detailBeat · Situation & Context
03
Includes a stylized photo of the speaker, a toaster graphic, and a person on a hoverboard.other
Open slide detailBeat · Situation & Context
06
The slide uses whimsical imagery (pug in a party hat, pizza, person on dog) to set a lighthearted tone for a conference presentation.transition
Open slide detailBeat · Situation & Context
07
The slide uses a process diagram to explain the flow from Data Source to Alert via the Risk Index.present_framework
Open slide detailBeat · Problem & Complication
08
The slide uses a collage aesthetic typical of modern tech conference presentations.transition
Open slide detailBeat · Problem & Complication
09
Likely a transition or culture-focused slide from a Splunk conference presentation.other
Open slide detailBeat · Problem & Complication
10
RBA likely stands for Risk-Based Alerting, a common Splunk framework.state_next_steps
Open slide detailBeat · Problem & Complication
12
This is a poll slide used during a presentation to engage the audience.frame_problem
13
The slide is a screenshot of a Splunk dashboard interface.diagnose
14
The slide uses a screenshot of a Splunk dashboard to illustrate the problem of skipped searches.diagnose
15
The slide uses a laptop mockup to display a data table of search performance metrics.diagnose
Open slide detailBeat · Solution & Approach
16
The slide uses a laptop mockup to frame a data visualization showing search scheduling patterns.diagnose
Open slide detailBeat · Solution & Approach
17
The slide uses surrealist imagery (giraffe, rover, pyramids) to set a thematic tone for the section.transition
Open slide detailBeat · Solution & Approach
18
The slide uses a semi-circular gauge or maturity model to categorize detection portfolio quality.diagnose
Open slide detailBeat · Solution & Approach
19
Splunk dashboard interface showing RBA metrics.summarize
Open slide detailBeat · Solution & Approach
21
The slide displays a table of risk rules and a summary metric bar for search complexity.analyze_data
Open slide detailBeat · Solution & Approach
22
The slide uses a laptop mockup to display a dashboard screenshot.diagnose
Open slide detailBeat · Solution & Approach
23
The slide uses a laptop graphic to display a table of unused indexes (azure, dlp, proxy).diagnose
Open slide detailBeat · Solution & Approach
24
The slide features a collage-style illustration with a person, teddy bear, camera, plant, security camera, and butterfly against a bar chart background.transition
Open slide detailBeat · Solution & Approach
25
Humorous engagement slide used during a presentation.filler
Open slide detailBeat · Solution & Approach
26
The slide contrasts a table of 'Notable Events' with a line chart of 'Top 10 Notable Events' over time.prioritize
Open slide detailBeat · Solution & Approach
27
The slide uses a simple multiplicative formula: Confidence x Impact = Risk Score.present_framework
28
The slide displays a UI component for calculating risk scores based on detection rules, confidence, and impact levels.present_solution
29
The diagram shows a complex web of security alerts (ESCU rules) connected to risk objects.diagnose
30
The slide shows a list of technical fields (e.g., certificate_common_name, process_hash) and a UI snippet for configuring Risk Analysis in Splunk.present_framework
31
The slide shows technical configuration details for security monitoring rules.analyze_data
Open slide detailBeat · Impact & Next Steps
34
The slide uses a playful, non-traditional visual style typical of conference branding (Splunk .conf23).transition
Open slide detailBeat · Impact & Next Steps
35
The slide uses a maturity model framework to categorize teams into four distinct archetypes.present_framework
Open slide detailBeat · Impact & Next Steps
36
The slide uses a visual equation to explain the risk scoring methodology.present_framework
Open slide detailBeat · Impact & Next Steps
37
The visualization uses a force-directed graph layout to map security rules (ESCU/Threat-RN) and their relationships to entities like 'user', 'dest', and 'src'.analyze_data
Open slide detailBeat · Impact & Next Steps
38
The slide uses a sidebar layout with a thematic illustration.diagnose
Open slide detailBeat · Impact & Next Steps
39
The chart shows a repetitive pattern of events over time, likely indicating a need for tuning as suggested by the text.diagnose
Open slide detailBeat · Impact & Next Steps
40
The slide uses a laptop graphic to frame the comparison data.compare_options
Open slide detailBeat · Impact & Next Steps
41
The slide includes a URL to the Splunkbase app page and a screenshot of a data model table.present_solution
Open slide detailBeat · Impact & Next Steps
42
The table highlights specific security rules that are failing to trigger or record events.diagnose
Open slide detailBeat · Impact & Next Steps
43
The slide uses a laptop mockup to display three pie charts representing cybersecurity coverage metrics.present_solution
Open slide detailBeat · Impact & Next Steps
44
The slide uses network diagrams to visualize alert coverage across the MITRE framework.analyze_data
Open slide detailBeat · Impact & Next Steps
45
Screenshot of a Splunk interface for CIM compliance validation.analyze_data
Open slide detailBeat · Impact & Next Steps
46
The slide shows technical Splunk SPL queries mapped to security tactics and techniques.analyze_data
Open slide detailBeat · Impact & Next Steps
47
The slide displays a screenshot of a software interface (RBA Navigator App) within a laptop frame.summarize
Open slide detailBeat · Impact & Next Steps
48
The slide features a whimsical, surreal collage of people, objects, and cityscapes, typical of Splunk's brand identity.other
Open slide detailBeat · Impact & Next Steps
50
The slide serves as a promotional announcement for a specific software tool.illustrate_case
Open slide detailBeat · Impact & Next Steps
52
This is a standard closing slide for a Splunk conference presentation.transition
Open slide detailBeat · Impact & Next Steps