{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-5eff-723e-9be5-920f70c17c85", "slug": "c5cd5f7c0292fe57", "title": "2023 conf SEC1096C", "subtitle": "Splunk", "author": "Splunk", "pageCount": 52, "kind": "consulting-deck", "orientation": "landscape", "aspectRatio": 1.778, "document": { "id": "019dd923-5eff-723e-9be5-920f70c17c85", "slug": "c5cd5f7c0292fe57", "title": "2023 conf SEC1096C", "rawTitle": "2023 conf SEC1096C", "authorId": "Splunk", "authorName": "Splunk", "authorDisplay": "Splunk", "kind": { "slug": "consulting-deck", "label": "Consulting deck" }, "sourceType": { "slug": "strategy_consulting", "label": "Strategy consulting" }, "fileName": "2023-conf-SEC1096C.pdf", "sourceUrl": null, "sourceDate": "2023-03-16 00:00:00", "presentationDate": null, "ingestedAt": "2026-04-27 02:45:19+00", "status": "ready", "pageCount": 52, "orientation": "landscape", "aspectRatio": 1.778, "targetCompany": null, "targetTicker": null, "metadata": { "local_root": "/tmp/legacy-images/c5cd5f7c0292fe57", "origin_corpus": "consulting" } }, "coverage": { "pageCount": 52, "pagesIndexed": 52, "pagesWithImages": 52, "pagesWithMetadata": 52, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 235, "chartCount": 15, "metricSlides": 0, "toolMatches": 26, "documentToolMatches": 0, "frameworkMatches": 6, "arcMatches": 1, "beatMatches": 4, "loopMatches": 2, "patternMatches": 0, "storymakersMatch": false, "scoreAvailable": true, "reviewAvailable": true, "activistThesisAvailable": false, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "evidence": "The deck follows a clear structure of situation/context, problem/complication, solution/approach, and impact/next steps.", "isPrimary": true, "confidence": 0.8, "extraction": { "at": "2026-07-16 21:27:52.352889+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "beats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null, "categoryName": "Strategy & Business", "categorySlug": "strategy-business" }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 14, "from": 12, "loop": { "name": "06_zoom_in", "slug": "06-zoom-in", "status": "active", "bestFor": "Technical deep-dives, case studies, detailed analysis", "canonId": "019dd956-6846-74db-82be-dff5b058b072", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Big Picture -> Key Area of Focus -> Specific Detail -> Implication", "description": "Start broad, then progressively focus on specific details that prove your point", "familyLabel": null, "categoryName": "Analysis", "categorySlug": "analysis" }, "matchId": "d80423c1-c9e2-4909-b04f-417280fee98a", "evidence": "The deck zooms in on specific issues with the current environment, such as skipped/deferred searches and long running searches.", "position": 0, "objective": "What are the specific issues with the current Splunk environment?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:27:52.525949+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } }, { "to": 30, "from": 27, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null, "categoryName": "Consulting Framework", "categorySlug": "consulting-framework" }, "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699", "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.", "position": 1, "objective": "How can teams break down their risk score and detection portfolio?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:27:52.559685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "tools": [ { "tool": { "name": "List presentation", "slug": "list-presentation", "status": "active", "bestFor": null, "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1", "version": 1, "bodyDocId": null, "description": "Bulleted, numbered, or checklist enumerations.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7e175b1b-c3ac-4eae-b60e-7e9304df066e", "evidence": "list/bullet: Risk Adaptive Action, Risk Rule (RR), Risk Object, Threat Object, Risk Incident Rule (RIR), Risk index, Risk Data Model", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:06.549807+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "efe56d42-1715-4049-a5c8-7b728d584dfe", "evidence": "image/photo: Group of eight people standing in a line", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:06.662858+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Call to action", "slug": "call-to-action", "status": "active", "bestFor": null, "canonId": "019dd9e1-4bbb-702a-9ead-82daf188bb7c", "version": 1, "bodyDocId": null, "description": "Explicit prescription of what the audience should do next.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "94b029c4-8c10-489a-86e9-d2e270c93f8b", "evidence": "paragraph/paragraph: Are you going to bring in help or do it yourself?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:06.738446+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "88cd09ce-6107-448c-9ef1-b1efe50f3140", "evidence": "title/headline: Health Check", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:06.811773+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "e7f9c447-eb49-4f16-b797-85bad5a6890b", "evidence": "list/bullet: A: Splunk is healthy and is monitored all the time! B: We keep an eye on some things. C: Someone smart looked at it awhile ago. D: We don't look in the general direction of our servers out of fear they will", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:06.887056+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "7878b0c8-ae66-4810-b192-565dd5eee961", "evidence": "Skipped searches are missed opportunities!", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:14.446933+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "9b9580a8-4af9-4a49-bd34-5cb7a0c6fb9a", "evidence": "Skipped/ Deferred Searches", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.482957+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "338f1ee4-ad53-452c-bac1-6fb81a7e46b8", "evidence": "Long running searches can lead to trouble.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.555485+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "0b08d206-9f17-465e-8977-7eba07f22fdd", "evidence": "Search Schedule Clustering - >5 Searches Scheduled at Same Time", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:14.629175+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 16, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "c56a98a5-d827-497a-92c6-f6c673809053", "evidence": "Understanding Where You Are Now", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:14.703012+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 17, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "2x2 matrix", "slug": "matrix-2x2", "status": "active", "bestFor": null, "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8", "version": 1, "bodyDocId": null, "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7d99f91e-fa97-475e-883b-1d5caf017c40", "evidence": "Portfolio Scale, Fancy Dumpster, Not too bad..., Hot Garbage", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 22:14:14.77756+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "0723bef0-e2ba-4f58-a2d9-06b3499bb3d8", "evidence": "What are your Alerts doing?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.888311+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "3c838ac9-51e8-41bc-af77-50f929bbcad4", "evidence": "What do your detections look like?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.962969+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 21, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "bed415aa-ddb2-472e-9f5e-ef07f19bed04", "evidence": "Pie chart showing distribution of data sources", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:15.036222+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 22, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "59b6b477-3ca9-48e6-b0ac-cbb153a671b6", "evidence": "What data sources are you NOT using?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:15.109251+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 23, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "aae08e9d-4121-4dfc-89ea-86bf77e3f25e", "evidence": "Strategy + Structure = Success!", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:15.182073+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "d4e9589d-b1e8-41b0-892a-70f3d1f276d2", "evidence": "Which Reddit community best describes your teams work style?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:15.255761+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Data-Ink Ratio", "slug": "data-ink-ratio", "status": "active", "bestFor": null, "canonId": "019dd956-afc8-70da-b378-92834d36fde6", "version": 1, "bodyDocId": null, "description": "Maximize data, minimize non-data ink - remove chartjunk and decoration", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "17e80fe6-1363-44c8-a55c-7c5afe3b48c8", "evidence": "table/data: Notable Events Without Risk table showing Data Source, Severity, Tactic, Technique, and specific alert details.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:29.561481+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "2x2 matrix", "slug": "matrix-2x2", "status": "active", "bestFor": null, "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8", "version": 1, "bodyDocId": null, "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "4ff7abf7-f23b-4921-98a7-e4963ad6f196", "evidence": "diagram/process: Confidence (High) x Impact (High) = Risk Score (100)", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:29.623624+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Network Effects Flywheel", "slug": "network-effects-flywheel", "status": "active", "bestFor": null, "canonId": "79fa8d3e-ef02-4ee8-ad12-f8e00a25cca1", "version": 1, "bodyDocId": null, "description": null, "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "251e9dbb-b83b-40b8-9eed-a1c34db4baf2", "evidence": "chart/dot: Network graph of security detection rules", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 22:14:29.96681+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 37, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem-Agitate-Solve (PAS)", "slug": "problem-agitate-solve-pas", "status": "active", "bestFor": null, "canonId": "019dd956-869f-7564-8d42-de54ed29ab90", "version": 1, "bodyDocId": null, "description": "Identify problem, agitate the pain, present the solution", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "009c0839-24f7-4cd3-9fbf-917e4a2b8699", "evidence": "The slide presents a problem (False Positives Happen!), agitates it by asking questions and suggesting actions, and implies a solution (having a process in place to address these ASAP).", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:04.907787+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 38, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Comparison frame", "slug": "comparison-frame", "status": "active", "bestFor": null, "canonId": "019dd9e1-484b-7399-a4fc-d14644b99f93", "version": 1, "bodyDocId": null, "description": "Two or more states/subjects placed side by side to expose a gap.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "6bbc3de0-edf5-4e84-8e25-e509b275d8e5", "evidence": "The slide compares data model vs index search performance using a bar chart and bullet points.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:05.018115+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 40, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Call to action", "slug": "call-to-action", "status": "active", "bestFor": null, "canonId": "019dd9e1-4bbb-702a-9ead-82daf188bb7c", "version": 1, "bodyDocId": null, "description": "Explicit prescription of what the audience should do next.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "8c6b9b53-3809-413a-801e-e624a10ecb00", "evidence": "The slide has a clear call-to-action title 'If you use Data Models, you need this app!!' and provides a link.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:05.093508+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 41, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null }, { "tool": { "name": "Storytelling: the closing ask", "slug": "closing-ask", "status": "active", "bestFor": null, "canonId": "019df269-24e0-70ab-8dd9-983832c1c665", "version": 1, "bodyDocId": "019df269-24bc-7554-b88d-245127606b8d", "description": "The single most important slide in the deck — after the cover. The final", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "0f9ef7ed-7514-4f97-a021-f3ee6a7390e8", "evidence": "The slide has a clear closing ask title 'Questions and Answers!'.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:05.387789+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 48, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "3a8af1e2-bde7-4ef2-a22e-afd7bd07d53c", "evidence": "RBA Navigator is a powerful tool designed to elevate the capabilities of IT security teams by going beyond the conventional approach of risk-based alerting.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:05.878942+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 50, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Storytelling: the closing ask", "slug": "closing-ask", "status": "active", "bestFor": null, "canonId": "019df269-24e0-70ab-8dd9-983832c1c665", "version": 1, "bodyDocId": "019df269-24bc-7554-b88d-245127606b8d", "description": "The single most important slide in the deck — after the cover. The final", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "ff096be4-0aaa-4630-ad28-0374dfc57bcc", "evidence": "Thank You", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:05.998378+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 52, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "107e997c-4242-4bc6-bf9a-f70febf4aa13", "evidence": "A 4-stage progression scale for detection portfolio quality.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "frameworkName": "maturity-model" }, { "matchId": "b61e2de1-d6ea-4f16-a17b-8275eb694ded", "evidence": "Formulaic representation of risk as a product of confidence and impact.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "frameworkName": "Risk Scoring Model" }, { "matchId": "0e66e364-0b68-45f3-b435-5211a27f4145", "evidence": "Categorization of teams into four progressive stages of maturity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:06.249+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 35, "frameworkName": "maturity-model" }, { "matchId": "ab87d66b-bd58-4c45-845f-7b2bec6a3161", "evidence": "Formulaic representation of risk score components", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 36, "frameworkName": "Risk Scoring Model" }, { "matchId": "49fc30ec-a7ef-40fc-9209-6ac325fc66e4", "evidence": "Explicit mention of MITRE ATT&CK coverage in title and body.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 43, "frameworkName": "MITRE ATT&CK" }, { "matchId": "a08933e7-3d07-48d0-bb26-d00778918a4e", "evidence": "Slide title and content reference MITRE ATT&CK framework", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 44, "frameworkName": "MITRE ATT&CK" } ], "patterns": [] }, "storymakers": null, "score": { "backend": "codex", "scoredAt": "2026-05-02 13:50:43.606+00", "subScores": { "scqa_arc": 50, "action_titles": 42, "mece_structure": 58, "closing_strength": 56, "evidence_quality": 67, "clarity_of_thesis": 42, "production_quality": 62, "visual_storytelling": 68 }, "totalScore": 56, "coveragePct": 100, "explanations": { "scqa_arc": "Slides 6-7 establish the situation and slides 13-16 introduce operational complications, but the answer is delivered as a sequence of product demos and tips rather than a clean Situation-Complication-Question-Answer arc.", "action_titles": "Several titles are commands or prompts, but many remain labels rather than insight sentences; for example, slide 13 uses \"RBA Health_Check\" instead of stating the health finding.", "mece_structure": "The section sequence in slides 5, 8, 17, 24, and 34 gives the deck a usable implementation path, but health check, current-state diagnosis, getting started, and leveling-up topics overlap and do not form a fully MECE argument.", "closing_strength": "Slides 49-51 provide lessons learned, an RBA Navigator call-to-action, and resources, but the closing does not synthesize a crisp recommendation or prioritized next-step plan before the final thank-you on slide 52.", "evidence_quality": "Technical claims are frequently supported by Splunk screenshots, tables, charts, and metrics on slides 13-16, 19-23, 26, and 40-47, while broader recommendations such as slides 38, 41, and 49 rely more on assertion.", "clarity_of_thesis": "The topic is clear by slides 2 and 5, but the first five slides offer a cover, bios, and agenda rather than a declarative thesis about why RBA should be adopted or how it changes SOC outcomes.", "production_quality": "Branding and visual language are consistent, but action-title density is uneven, some screenshots are dense, footnote/source discipline is limited, and structural sequencing is weakened by Q&A on slide 48 before takeaways and resources.", "visual_storytelling": "The deck often matches message to medium with dashboards, tables, equations, and network diagrams on slides 13-16, 27, 36, and 40-47, though dense screenshots and filler transitions dilute the storytelling signal." }, "slidesAnalyzed": 52 }, "review": { "backend": null, "verdict": "This is a solid technical conference enablement deck with useful practitioner evidence, but only a mid-tier Storymakers exemplar because it lacks answer-first framing, consistently declarative titles, and a sharp close.", "reviewedAt": "2026-05-01 21:44:38.482+00", "slidesSeen": 52, "suggestions": [ "Add an answer-first executive slide after the cover: RBA succeeds when teams set goals, inspect health, diagnose detection/data coverage, and evolve scoring with explicit resources.", "Rewrite major section dividers as MECE claims, for example \"Healthy RBA starts with search hygiene,\" \"Detection coverage determines alert value,\" and \"Risk scoring should mature in stages.\"", "Convert question/topic titles into insight titles, such as changing slide 22 from \"What data sources are you using?\" to \"Unused data sources leave detection coverage on the table.\"", "Move the Q&A slide after takeaways and resources, or replace it with a final action slide that asks the audience to run a health check, audit unused data, and install/use RBA Navigator.", "Separate optional polls and humor breaks from the core storyline so the table of contents reads as a progression rather than an event script." ], "closingScore": 62, "openingScore": 38, "topStrengths": [ "The deck follows a practical operator journey from RBA definition on slide 7 to health issues on slides 13-16, portfolio diagnosis on slides 18-23, and implementation mechanics on slides 26-47.", "Several diagnostic slides create concrete operational tension, especially skipped searches on slide 14, long-running searches on slide 15, and schedule clustering on slide 16.", "The visual storytelling is grounded in product evidence, with dashboard screenshots and technical artifacts recurring across slides 19-23, 26, 31, and 40-47." ], "topWeaknesses": [ "The opening waits too long to declare the point: slides 1-5 are disclaimer, cover, bios, and agenda rather than a thesis or audience problem.", "The deck mixes narrative slides with polls and filler, so slides 9, 25, and 35 dilute the throughline instead of advancing the argument.", "Many titles are topic labels or questions rather than conclusions, including slides 13, 18, 27, 28, 30, 33, 36, 45, 46, and 47." ], "narrativeScore": 68, "pillarCritique": "The section dividers are partially MECE as a maturity journey: setup, health check, current state, getting started, and leveling up. They also function as topic breaks, with filler/poll slides such as slides 9, 25, and 35 interrupting the pillar logic.", "closingCritique": "The last 5 slides include Q&A, lessons learned, the RBA Navigator app, resources, and thanks, so there is some follow-through for practitioners. The close is not especially memorable because slide 48 starts Q&A before the takeaways, and the deck never lands on one explicit commitment, recommendation, or implementation plan.", "openingCritique": "The first 5 slides establish session logistics, speaker credibility, and an agenda, but they do not state the core answer or stakes. The first real hook appears on slide 6 with security as a never-ending journey, and the deck does not clearly lead with a recommendation in the first 3 slides.", "extractionSeconds": 59.843, "narrativeCritique": "The deck has a workable setup -> tension -> analysis -> resolution arc: front matter/context on slides 1-7, health-check tension on slides 8-16, current-state diagnosis on slides 17-23, and implementation/level-up guidance on slides 24-47. It is missing a crisp answer-first thesis and spends enough time in demos, polls, and reference material that the story often feels like a technical walkthrough rather than a shaped argument.", "titleQualityScore": 56, "titleQualityCritique": "Titles are often useful prompts or imperatives, but many are not insight-bearing action titles: slide 20 asks \"What are your Alerts doing?\" and slide 45 says only \"CIM Compliance.\" Stronger examples appear when the title or callout states the point, such as slide 41 \"If you use Data Models, you need this app!!\" and slide 14's callout \"Skipped searches are missed opportunities!\"" }, "activistThesis": null, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "function": "front_matter", "imagePath": "https://imgproxy.kitesheet.com/DS7wT5pqC8K2xAt8Lj4JLYCa8NiPK_G0ocS5KXNmAmI/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9jNWNkNWY3YzAyOTJmZTU3L3AwMDEuanBn", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "balanced", "densityScore": 32, "componentCount": 4, "textChars": 545, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.048+00", "seconds": 2.776, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/1", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-1", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.05, "w": 0.58, "x": 0.37, "y": 0.86 }, "kind": "disclaimer", "text": "Splunk, Splunk> and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2023 Splunk Inc. All rights reserved.", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "01c97024-dc67-4c1e-861c-8ad888adaca4", "parentComponentId": null }, { "bbox": { "h": 0.75, "w": 0.58, "x": 0.37, "y": 0.12 }, "kind": "disclaimer", "text": "This presentation may contain forward-looking statements regarding future events, plans or the expected financial performance of our company... In addition, any information about our roadmap outlines our general product direction and is subject to change.", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0914f575-844f-4d54-8a7a-b36510ea9259", "parentComponentId": null }, { "bbox": { "h": 0.5, "w": 0.28, "x": 0.05, "y": 0.45 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "af5348b8-21fc-4d2c-b89a-f1ceea763d88", "parentComponentId": null }, { "bbox": { "h": 0.33, "w": 0.28, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "Forward-Looking Statements", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "42439c90-d654-4d5e-9c08-926e6ed73cc6", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/o7SBbbTU1RnK-KuPJdJ3swgjbr1DY7w6-wlNSMUJgKk/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9jNWNkNWY3YzAyOTJmZTU3L3AwMDEuanBn", "imagePathAlt": "https://imgproxy.kitesheet.com/mMIHEi8zuIYeTpurL94r9Ap13eztdPZugsuqefnzAwk/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9jNWNkNWY3YzAyOTJmZTU3L3AwMDEucG5n", "thumbSrcAlt": "https://imgproxy.kitesheet.com/Hh3KLGEmpMCCv5hEGk0AOWL4kuV3rHWpzMlJwfnxUTc/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9jNWNkNWY3YzAyOTJmZTU3L3AwMDEucG5n" }, { "page": 2, "type": "setup", "title": "Includes speaker name, title, company, and session code.", "function": "front_matter", "rawType": "cover", "block": null, "metadata": { "slideType": "cover", "slideTypeCanon": { "name": "Cover", "slug": "cover", "status": "active", "canonId": "019de52d-05f2-729d-9f93-e0504f0a2410", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "sparse", "densityScore": 21, "componentCount": 5, "textChars": 141, "nDataPoints": 0, "notes": "Includes speaker name, title, company, and session code.", "elementsJson": [ "headline_text", "subtitle_text", "photo", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.604+00", "seconds": 6.06, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/2", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-2", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.1, "w": 0.25, "x": 0.7, "y": 0.85 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.604+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "82774265-38c9-4073-8bc2-fb34dbfd609c", "parentComponentId": null }, { "bbox": { "h": 0.75, "w": 0.43, "x": 0.535, "y": 0.1 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.604+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "914c2d1e-4c81-4da9-8cdf-bc9a7493b153", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.4, "x": 0.05, "y": 0.65 }, "kind": "paragraph", "text": "Matt Snyder\nProgram Lead - Advanced Security Analytics\nVMware", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.604+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1ba00c32-bfb2-4016-ae86-9f350eb93986", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.45, "x": 0.05, "y": 0.3 }, "kind": "title", "text": "Beyond Enablement", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.604+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c6840c7a-5d12-4018-be89-0095d50a65c9", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.4, "x": 0.05, "y": 0.4 }, "kind": "title", "text": "Harnessing the Power of RBA to Help Transform Your SOC SEC1096C", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.604+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "412496a0-3c2a-4de4-9a2a-c5ede02eb9b9", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 3, "type": "setup", "title": "Includes a stylized photo of the speaker, a toaster graphic, and a person on a hoverboard.", "function": "other", "rawType": "team_bio", "block": null, "metadata": { "slideType": "team_bio", "slideTypeCanon": { "name": "Team bio", "slug": "team_bio", "status": "active", "canonId": "019de52d-0a7d-7394-ae5b-037478e71f1e", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 18, "componentCount": 5, "textChars": 62, "nDataPoints": 0, "notes": "Includes a stylized photo of the speaker, a toaster graphic, and a person on a hoverboard.", "elementsJson": [ "headshot", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:03.359+00", "seconds": 3.781, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/3", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-3", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.4, "w": 0.4, "x": 0.08, "y": 0.17 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Headshot", "slug": "headshot", "status": "active", "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf", "version": 1, "description": null }, "framework": null }, "subkind": "headshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bb183fb7-ff7d-47ef-80ce-b6ed9d2f9ee0", "parentComponentId": null }, { "bbox": { "h": 0.9, "w": 0.15, "x": 0.01, "y": 0.23 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "08bd2261-3119-45d7-a915-45035c5f033a", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.12, "x": 0.38, "y": 0.63 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "92c57da9-f66f-43cb-8dde-60964702830f", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.35, "x": 0.49, "y": 0.45 }, "kind": "paragraph", "text": "Program Lead - Advanced Security Analytics | VMware", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f12419b2-ab67-4b9c-bb27-97494aa38d77", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.49, "y": 0.4 }, "kind": "title", "text": "Matt Snyder", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "94129cfe-779c-4a36-a398-f24d643ba901", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 4, "type": "setup", "function": "summarize", "rawType": "team_bio", "block": null, "metadata": { "slideType": "team_bio", "slideTypeCanon": { "name": "Team bio", "slug": "team_bio", "status": "active", "canonId": "019de52d-0a7d-7394-ae5b-037478e71f1e", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "sparse", "densityScore": 16, "componentCount": 3, "textChars": 154, "nDataPoints": 5, "notes": null, "elementsJson": [ "headline_text", "bullet_list", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.1+00", "seconds": 2.388, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/4", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-4", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.25, "w": 0.35, "x": 0, "y": 0.75 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.1+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "45c98bba-a27f-447a-9527-beae79ed9407", "parentComponentId": null }, { "bbox": { "h": 0.6, "w": 0.5, "x": 0.43, "y": 0.15 }, "kind": "list", "text": "18 years in the IT Security field\n10 years using Splunk\n7th .conf\n5 in-person\n2 virtual\n2nd time as a Speaker\nMITRE ATT&CK Contributor (T1562.008)", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.1+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6e4d4e82-2f11-4ed3-8d62-28e800720fe6", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "About Me", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.1+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c9643726-634e-442d-a2f5-09d339a24cd9", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 5, "type": "setup", "function": "summarize", "rawType": "agenda", "block": null, "metadata": { "slideType": "agenda", "slideTypeCanon": { "name": "Agenda", "slug": "agenda", "status": "active", "canonId": "019de52d-061b-7470-b138-3ffa5e612cce", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "sparse", "densityScore": 8, "componentCount": 3, "textChars": 103, "nDataPoints": 0, "notes": null, "elementsJson": [ "bullet_list", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.569+00", "seconds": 2.554, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/5", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-5", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.25, "w": 0.37, "x": 0, "y": 0.75 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.569+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d5e29b06-3efc-4c7d-a577-bf5793467441", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.3, "x": 0.43, "y": 0.15 }, "kind": "list", "text": "Setting up for success\nUnderstanding where you are\nGetting started\nPersistent evolution", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.569+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b6294c46-3753-417e-9564-ced64b3e06c2", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "Session Overview", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.569+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ac5fc4be-4426-4978-b8c8-585e5e700335", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 6, "type": "setup", "title": "The slide uses whimsical imagery (pug in a party hat, pizza, person on dog) to set a lighthearted tone for a conference presentation.", "function": "transition", "rawType": "transition", "block": null, "metadata": { "slideType": "transition", "slideTypeCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-0693-7766-9f05-887f41f8e41e", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 13, "componentCount": 4, "textChars": 117, "nDataPoints": 0, "notes": "The slide uses whimsical imagery (pug in a party hat, pizza, person on dog) to set a lighthearted tone for a conference presentation.", "elementsJson": [ "headline_text", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.247+00", "seconds": 2.109, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/6", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-6", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "This is a never ending journey.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-3c0f27342056", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.4, "x": 0.55, "y": 0.15 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.247+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7aac6ebd-bcf3-4a89-9b64-c6d9fcf1bfe2", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.05, "y": 0.75 }, "kind": "paragraph", "text": "This is a never ending journey.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.247+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d80f16cf-ca3c-4880-9511-adf804dbe228", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.4, "x": 0.05, "y": 0.2 }, "kind": "title", "text": "Everyone is looking for ways to improve their security!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.247+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "328ea828-eafc-44b2-bb99-815d4c2003af", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 6, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 1, "name": "Situation & Context", "beatId": "7e6ba800-cf8c-467b-ac30-e2f2c95e5b1c", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Situation & Context", "slug": "consultants-gambit-situation-context", "status": "active", "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3", "version": 1, "description": null }, "evidence": "The deck starts with an introduction, team bio, and session overview.", "position": 0, "isPrimaryArc": true, "parentBeatType": { "name": "Setup", "slug": "setup", "status": "active", "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc", "version": 1, "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 7, "type": "appendix", "title": "The slide uses a process diagram to explain the flow from Data Source to Alert via the Risk Index.", "function": "present_framework", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_framework", "functionCanon": { "name": "Present framework", "slug": "present_framework", "status": "active", "canonId": "019de52d-1403-7667-9100-d2ac6709f750", "version": 1, "description": null }, "density": "balanced", "densityScore": 26, "componentCount": 5, "textChars": 276, "nDataPoints": 0, "notes": "The slide uses a process diagram to explain the flow from Data Source to Alert via the Risk Index.", "elementsJson": [ "headline_text", "process_diagram", "bullet_list", "footnote", "photo" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:03.445+00", "seconds": 3.004, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/7", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-7", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.3, "w": 0.35, "x": 0.05, "y": 0.25 }, "kind": "diagram", "text": "Flow diagram showing Data Source -> Risk Index -> Alert", "attrs": null, "canon": { "kind": { "name": "Diagram", "slug": "diagram", "status": "active", "canonId": "019de52c-f9f0-734a-81de-15382ff28c65", "version": 1, "description": "Schematic or relational diagram." }, "tool": null, "subkind": { "name": "Process flow", "slug": "process", "status": "active", "canonId": "019de52d-039c-718f-ad3a-efe9c4b3c838", "version": 1, "description": null }, "framework": null }, "subkind": "process", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.445+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8ba6d830-dc3e-4e98-a4c3-5e0812eb0eee", "parentComponentId": null }, { "bbox": { "h": 0.6, "w": 0.5, "x": 0.42, "y": 0.25 }, "kind": "list", "text": "Risk Adaptive Action, Risk Rule (RR), Risk Object, Threat Object, Risk Incident Rule (RIR), Risk index, Risk Data Model", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.445+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "831988d9-d240-47a0-87cb-7b8911eef523", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.35, "x": 0.05, "y": 0.55 }, "kind": "source-note", "text": "Image Source: The Essential Guide to Risk Based Alerting by Haylee Mills", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.445+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "abdf9c3c-4d5e-43fc-8186-ef17adb626f8", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.42, "y": 0.15 }, "kind": "title", "text": "Key Terms:", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.445+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4567e26c-8728-4d22-aaa5-b1c81c1d2268", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "RBA in 30 Seconds...", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.445+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f01133e-04c1-4535-984f-caa390ed5758", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "List presentation", "slug": "list-presentation", "status": "active", "bestFor": null, "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1", "version": 1, "bodyDocId": null, "description": "Bulleted, numbered, or checklist enumerations.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7e175b1b-c3ac-4eae-b60e-7e9304df066e", "evidence": "list/bullet: Risk Adaptive Action, Risk Rule (RR), Risk Object, Threat Object, Risk Incident Rule (RIR), Risk index, Risk Data Model", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:06.549807+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 8, "type": "setup", "title": "The slide uses a collage aesthetic typical of modern tech conference presentations.", "function": "transition", "rawType": "transition", "block": null, "metadata": { "slideType": "transition", "slideTypeCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-0693-7766-9f05-887f41f8e41e", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 5, "componentCount": 3, "textChars": 23, "nDataPoints": 0, "notes": "The slide uses a collage aesthetic typical of modern tech conference presentations.", "elementsJson": [ "photo", "infographic" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.311+00", "seconds": 4.855, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/8", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-8", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.918, "w": 0.483, "x": 0.044, "y": 0.082 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "79ab2c2a-8ad1-4431-b154-76b9b19f7824", "parentComponentId": null }, { "bbox": { "h": 0.094, "w": 0.242, "x": 0.7, "y": 0.848 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d6d3a19f-b0be-4245-ad5c-0ab1d8126282", "parentComponentId": null }, { "bbox": { "h": 0.158, "w": 0.415, "x": 0.527, "y": 0.255 }, "kind": "title", "text": "Setting up for success!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "566af948-6e6f-49ab-9c2d-971a0116b21c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 9, "type": "appendix", "title": "Likely a transition or culture-focused slide from a Splunk conference presentation.", "function": "other", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 7, "componentCount": 3, "textChars": 79, "nDataPoints": 0, "notes": "Likely a transition or culture-focused slide from a Splunk conference presentation.", "elementsJson": [ "action_title", "photo" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.795+00", "seconds": 2.278, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/9", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-9", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.65, "w": 0.9, "x": 0.05, "y": 0.25 }, "kind": "image", "text": "Group of eight people standing in a line", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.795+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "000172b6-d592-4ab9-be1f-5487d67f8faa", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.1, "x": 0.85, "y": 0.92 }, "kind": "other", "text": "Splunk .conf23 logo", "attrs": null, "canon": { "kind": { "name": "Other", "slug": "other", "status": "active", "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d", "version": 1, "description": "Fallback when no canonical kind applies." }, "tool": null, "subkind": { "name": "Unclassified", "slug": "unclassified", "status": "active", "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0", "version": 1, "description": null }, "framework": null }, "subkind": "unclassified", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.795+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "553bb5e1-bf62-437e-9323-8643e12c80fc", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.4, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Set Goals as a Team!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.795+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1c1bbd13-9f73-48d6-bfe5-6f448448eec9", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "efe56d42-1715-4049-a5c8-7b728d584dfe", "evidence": "image/photo: Group of eight people standing in a line", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:06.662858+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 9, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 10, "type": "setup", "title": "RBA likely stands for Risk-Based Alerting, a common Splunk framework.", "function": "state_next_steps", "rawType": "next_steps", "block": null, "metadata": { "slideType": "next_steps", "slideTypeCanon": { "name": "Next steps", "slug": "next_steps", "status": "active", "canonId": "019de52d-0c5e-717b-b460-a68269e6078e", "version": 1, "description": null }, "function": "state_next_steps", "functionCanon": { "name": "State next steps", "slug": "state_next_steps", "status": "active", "canonId": "019de52d-14ca-70ac-b534-971f458cdf29", "version": 1, "description": null }, "density": "sparse", "densityScore": 19, "componentCount": 4, "textChars": 264, "nDataPoints": 0, "notes": "RBA likely stands for Risk-Based Alerting, a common Splunk framework.", "elementsJson": [ "headline_text", "icon_grid" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.113+00", "seconds": 3.28, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/10", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-10", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.3, "w": 0.8, "x": 0.1, "y": 0.45 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Icon grid", "slug": "icon-grid", "status": "active", "canonId": "019de52c-fdfe-749d-9990-1db465a3eed4", "version": 1, "description": null }, "framework": null }, "subkind": "icon-grid", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.113+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aeb15e09-8fbf-4686-8974-d2ae21580897", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.3 }, "kind": "list", "text": "Professional Services or DIY\nFull RBA Implementation or Focused Use Case\nRBA Maturity Cycle", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.113+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3bc2632a-05b6-454b-bd8e-ecc9f6549a23", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.75 }, "kind": "paragraph", "text": "Are you going to bring in help or do it yourself?\nWhat are you going to focus on?\nYou have RBA deployed, now your in a continuous improvement cycle.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.113+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "532c05ae-1889-4212-b905-eb7d70d5a5a3", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.4, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "What are you going to do?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.113+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ee4a8862-8722-4933-8dff-7e408b402799", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Call to action", "slug": "call-to-action", "status": "active", "bestFor": null, "canonId": "019dd9e1-4bbb-702a-9ead-82daf188bb7c", "version": 1, "bodyDocId": null, "description": "Explicit prescription of what the audience should do next.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "94b029c4-8c10-489a-86e9-d2e270c93f8b", "evidence": "paragraph/paragraph: Are you going to bring in help or do it yourself?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:06.738446+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 10, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 11, "type": "setup", "function": "transition", "rawType": "section_divider", "block": null, "metadata": { "slideType": "section_divider", "slideTypeCanon": { "name": "Section divider", "slug": "section_divider", "status": "active", "canonId": "019de52d-066a-7402-9554-6ae504999041", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 5, "componentCount": 3, "textChars": 12, "nDataPoints": 0, "notes": null, "elementsJson": [ "photo", "other" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:02.878+00", "seconds": 2.021, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/11", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-11", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.88, "w": 0.44, "x": 0.082, "y": 0.1 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.878+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c6d11828-f345-4a92-b3f1-d678058b867c", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.24, "x": 0.7, "y": 0.85 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.878+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "07bcb54b-27b1-42e9-816e-b774c0c7e141", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.295, "x": 0.527, "y": 0.365 }, "kind": "title", "text": "Health Check", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:02.878+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1689a477-03d9-4339-b533-e3ca87511931", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "88cd09ce-6107-448c-9ef1-b1efe50f3140", "evidence": "title/headline: Health Check", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:06.811773+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 12, "type": "appendix", "title": "This is a poll slide used during a presentation to engage the audience.", "function": "frame_problem", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "frame_problem", "functionCanon": { "name": "Frame problem", "slug": "frame_problem", "status": "active", "canonId": "019de52d-13db-753e-ad70-e9b2d0dab398", "version": 1, "description": null }, "density": "sparse", "densityScore": 16, "componentCount": 3, "textChars": 282, "nDataPoints": 0, "notes": "This is a poll slide used during a presentation to engage the audience.", "elementsJson": [ "headline_text", "icon_grid" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.646+00", "seconds": 4.746, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/12", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-12", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.4, "w": 0.9, "x": 0.05, "y": 0.45 }, "kind": "list", "text": "A: Splunk is healthy and is monitored all the time! B: We keep an eye on some things. C: Someone smart looked at it awhile ago. D: We don't look in the general direction of our servers out of fear they will die!", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.646+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2da471de-b580-48a6-9a3e-e9135632f937", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.75, "x": 0.05, "y": 0.06 }, "kind": "title", "text": "When was the last time your Splunk environment had a check up?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.646+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f56280b3-47e6-43c8-b982-dab6f413b2ff", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.21 }, "kind": "title", "text": "Poll Time", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.646+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8cf71b5c-d5f2-4085-87a7-1a47dee37e38", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "e7f9c447-eb49-4f16-b797-85bad5a6890b", "evidence": "list/bullet: A: Splunk is healthy and is monitored all the time! B: We keep an eye on some things. C: Someone smart looked at it awhile ago. D: We don't look in the general direction of our servers out of fear they will", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:06.887056+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 12, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 14, "from": 12, "loop": { "name": "06_zoom_in", "slug": "06-zoom-in", "status": "active", "bestFor": "Technical deep-dives, case studies, detailed analysis", "canonId": "019dd956-6846-74db-82be-dff5b058b072", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Big Picture -> Key Area of Focus -> Specific Detail -> Implication", "description": "Start broad, then progressively focus on specific details that prove your point", "familyLabel": null }, "matchId": "d80423c1-c9e2-4909-b04f-417280fee98a", "evidence": "The deck zooms in on specific issues with the current environment, such as skipped/deferred searches and long running searches.", "position": 0, "objective": "What are the specific issues with the current Splunk environment?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:27:52.525949+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 13, "type": "analysis", "title": "The slide is a screenshot of a Splunk dashboard interface.", "function": "diagnose", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 28, "componentCount": 5, "textChars": 132, "nDataPoints": 15, "notes": "The slide is a screenshot of a Splunk dashboard interface.", "elementsJson": [ "bar_chart_horizontal", "data_table", "bar_chart_vertical" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:03.929+00", "seconds": 2.984, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/13", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-13", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.12, "w": 0.88, "x": 0.06, "y": 0.24 }, "kind": "chart", "text": "Search Status", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a3db3814-f765-4e38-9a5d-1330470905d6", "parentComponentId": null }, { "bbox": { "h": 0.22, "w": 0.88, "x": 0.06, "y": 0.66 }, "kind": "chart", "text": "Search Schedule Clustering - >5 Searches Scheduled at Same Time", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Vertical bar chart", "slug": "bar-vertical", "status": "active", "canonId": "019de52c-fe9d-70f2-b3b7-a9ae294f5917", "version": 1, "description": null }, "framework": null }, "subkind": "bar-vertical", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a5485c6c-1ecb-4fa9-94fe-b7bce4c6571e", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Search Status: 1925", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-09469db73eb9", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.88, "x": 0.06, "y": 0.38 }, "kind": "table", "text": "Long Running Searches", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2373c2a9-da37-4dd1-a856-2e1f50879a72", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.06, "y": 0.15 }, "kind": "title", "text": "RBA Health_Check", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.929+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "da8e32a7-a4f2-4c47-add5-6ce887dd447c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 14, "from": 12, "loop": { "name": "06_zoom_in", "slug": "06-zoom-in", "status": "active", "bestFor": "Technical deep-dives, case studies, detailed analysis", "canonId": "019dd956-6846-74db-82be-dff5b058b072", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Big Picture -> Key Area of Focus -> Specific Detail -> Implication", "description": "Start broad, then progressively focus on specific details that prove your point", "familyLabel": null }, "matchId": "d80423c1-c9e2-4909-b04f-417280fee98a", "evidence": "The deck zooms in on specific issues with the current environment, such as skipped/deferred searches and long running searches.", "position": 0, "objective": "What are the specific issues with the current Splunk environment?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:27:52.525949+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 14, "type": "analysis", "title": "The slide uses a screenshot of a Splunk dashboard to illustrate the problem of skipped searches.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 28, "componentCount": 5, "textChars": 213, "nDataPoints": 3, "notes": "The slide uses a screenshot of a Splunk dashboard to illustrate the problem of skipped searches.", "elementsJson": [ "headline_text", "paragraph", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:03.679+00", "seconds": 2.263, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/14", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-14", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Skipped searches are missed opportunities!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-5113be854154", "parentComponentId": null }, { "bbox": { "h": 0.895, "w": 0.65, "x": 0.32, "y": 0.084 }, "kind": "image", "text": "Dashboard showing search status counts: continued (577), skipped (391), success (1925)", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.679+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9f069c20-e607-4533-935e-09d0001c921a", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Search count: 391", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-56f604f8dff1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.25, "x": 0.05, "y": 0.615 }, "kind": "paragraph", "text": "Skipped searches are missed opportunities!", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.679+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b53bc912-c15e-4c82-add1-b36177dc30f0", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.25, "x": 0.05, "y": 0.3 }, "kind": "title", "text": "Skipped/ Deferred Searches", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.679+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "256b7944-f5ae-4528-b97f-652366c026a4", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Audience Definition", "slug": "audience-definition", "status": "active", "bestFor": null, "canonId": "019dd956-7f2a-775d-aeee-ff099bcb7756", "version": 1, "bodyDocId": null, "description": "Six key questions: Who are they? What do they know? What do they believe? What do they care about? What do they fear? What decisions can they make?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "7878b0c8-ae66-4810-b192-565dd5eee961", "evidence": "Skipped searches are missed opportunities!", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:14.446933+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "9b9580a8-4af9-4a49-bd34-5cb7a0c6fb9a", "evidence": "Skipped/ Deferred Searches", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.482957+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 14, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 7, "name": "Problem & Complication", "beatId": "665ec750-d8bc-4530-bfb1-382979bbf648", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Problem & Complication", "slug": "consultants-gambit-problem-complication", "status": "active", "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4", "version": 1, "description": null }, "evidence": "The deck presents a health check and diagnosis of the current Splunk environment.", "position": 1, "isPrimaryArc": true, "parentBeatType": { "name": "Complication", "slug": "complication", "status": "active", "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579", "version": 1, "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 14, "from": 12, "loop": { "name": "06_zoom_in", "slug": "06-zoom-in", "status": "active", "bestFor": "Technical deep-dives, case studies, detailed analysis", "canonId": "019dd956-6846-74db-82be-dff5b058b072", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Big Picture -> Key Area of Focus -> Specific Detail -> Implication", "description": "Start broad, then progressively focus on specific details that prove your point", "familyLabel": null }, "matchId": "d80423c1-c9e2-4909-b04f-417280fee98a", "evidence": "The deck zooms in on specific issues with the current environment, such as skipped/deferred searches and long running searches.", "position": 0, "objective": "What are the specific issues with the current Splunk environment?", "confidence": 0.7, "extraction": { "at": "2026-07-16 21:27:52.525949+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 15, "type": "analysis", "title": "The slide uses a laptop mockup to display a data table of search performance metrics.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 6, "textChars": 245, "nDataPoints": 9, "notes": "The slide uses a laptop mockup to display a data table of search performance metrics.", "elementsJson": [ "headline_text", "paragraph", "screenshot", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.098+00", "seconds": 2.6, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/15", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-15", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Long running searches can lead to trouble.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-5500cdee3de9", "parentComponentId": null }, { "bbox": { "h": 0.9, "w": 0.68, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop mockup displaying the search table.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.098+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0ae80d3e-251e-480d-8391-ce7bc3602402", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "total_run_time", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-5bd9058f9037", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.25, "x": 0.05, "y": 0.615 }, "kind": "paragraph", "text": "Long running searches can lead to trouble.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.098+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c8dd429a-88c4-48a3-8d2b-1d3c27c0f950", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.6, "x": 0.36, "y": 0.26 }, "kind": "table", "text": "Table showing savedsearch_name, app, user, total_run_time, and search query details.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.098+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "823d4b54-dbe0-48a2-a420-9c855bd40d40", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.25, "x": 0.05, "y": 0.3 }, "kind": "title", "text": "Long Running Searches", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.098+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c89d0b9a-9077-4dee-b0b7-f59e5480bf4f", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "338f1ee4-ad53-452c-bac1-6fb81a7e46b8", "evidence": "Long running searches can lead to trouble.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.555485+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 15, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 16, "type": "analysis", "title": "The slide uses a laptop mockup to frame a data visualization showing search scheduling patterns.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 38, "componentCount": 6, "textChars": 219, "nDataPoints": 10, "notes": "The slide uses a laptop mockup to frame a data visualization showing search scheduling patterns.", "elementsJson": [ "headline_text", "bar_chart_vertical", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.356+00", "seconds": 2.768, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/16", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-16", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Are you causing problems by stacking scheduled searches?", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a3-cbc42a82b912", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.6, "x": 0.36, "y": 0.25 }, "kind": "chart", "text": "Search Schedule Clustering - >5 Searches Scheduled at Same Time", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Vertical bar chart", "slug": "bar-vertical", "status": "active", "canonId": "019de52c-fe9d-70f2-b3b7-a9ae294f5917", "version": 1, "description": null }, "framework": null }, "subkind": "bar-vertical", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.356+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a5014dda-c4e9-4d29-b1e3-f1116080c52e", "parentComponentId": null }, { "bbox": { "h": 0.9, "w": 0.68, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop mockup", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.356+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6ae11420-72a3-4d77-9721-8f195cc398cd", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Search count", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a3-ccc254352861", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.3, "x": 0.05, "y": 0.57 }, "kind": "paragraph", "text": "Are you causing problems by stacking scheduled searches?", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.356+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c9f8c183-3440-495d-a21a-501368ea5b27", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.25, "x": 0.05, "y": 0.34 }, "kind": "title", "text": "Schedule Clustering", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.356+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e3f829ba-642e-4e9b-aa24-e9e078d2121f", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "0b08d206-9f17-465e-8977-7eba07f22fdd", "evidence": "Search Schedule Clustering - >5 Searches Scheduled at Same Time", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:14.629175+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 16, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 17, "type": "setup", "title": "The slide uses surrealist imagery (giraffe, rover, pyramids) to set a thematic tone for the section.", "function": "transition", "rawType": "section_divider", "block": null, "metadata": { "slideType": "section_divider", "slideTypeCanon": { "name": "Section divider", "slug": "section_divider", "status": "active", "canonId": "019de52d-066a-7402-9554-6ae504999041", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 4, "textChars": 145, "nDataPoints": 0, "notes": "The slide uses surrealist imagery (giraffe, rover, pyramids) to set a thematic tone for the section.", "elementsJson": [ "headline_text", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:03.58+00", "seconds": 1.979, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/17", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-17", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Knowing where you are today is a critical key to success.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-272156dd2a2b", "parentComponentId": null }, { "bbox": { "h": 0.8, "w": 0.5, "x": 0.48, "y": 0.1 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "95f9e598-2c0d-48fe-81f4-5ab4802b5134", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.35, "x": 0.05, "y": 0.6 }, "kind": "paragraph", "text": "Knowing where you are today is a critical key to success.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fc25b22c-0393-4b76-b8d0-f2d476bd154f", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.35, "x": 0.05, "y": 0.3 }, "kind": "title", "text": "Understanding Where You Are Now", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:03.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f4bc306a-4fa5-42a3-a000-d77297d21364", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "c56a98a5-d827-497a-92c6-f6c673809053", "evidence": "Understanding Where You Are Now", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:14.703012+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 17, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 18, "type": "analysis", "title": "The slide uses a semi-circular gauge or maturity model to categorize detection portfolio quality.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 6, "textChars": 105, "nDataPoints": 0, "notes": "The slide uses a semi-circular gauge or maturity model to categorize detection portfolio quality.", "elementsJson": [ "headline_text", "infographic" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.103+00", "seconds": 3.26, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/18", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-18", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.35, "w": 0.44, "x": 0.28, "y": 0.5 }, "kind": "framework", "text": "Portfolio Scale", "attrs": null, "canon": { "kind": { "name": "Framework", "slug": "framework", "status": "active", "canonId": "019de52c-fa18-77c6-b10a-ccb8277ac0fa", "version": 1, "description": "Named conceptual framework instance." }, "tool": null, "subkind": { "name": "Framework instance", "slug": "instance", "status": "active", "canonId": "019de52d-05a2-72af-be0b-7edc60708a03", "version": 1, "description": null }, "framework": null }, "subkind": "instance", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cb449f0d-37b5-4dbd-b2c1-a7588b069b48", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.12, "x": 0.27, "y": 0.42 }, "kind": "paragraph", "text": "Fancy Dumpster", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "370e9279-84f0-4f1f-bb8e-dcd961b939be", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.12, "x": 0.72, "y": 0.65 }, "kind": "paragraph", "text": "Next Level Awesome!", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f07f9886-1a75-4218-ba23-014dd27b5366", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.1, "x": 0.12, "y": 0.65 }, "kind": "paragraph", "text": "Hot Garbage", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f2d8cb42-4d3b-410a-abc0-aaee48c61b02", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.12, "x": 0.53, "y": 0.42 }, "kind": "paragraph", "text": "Not too bad...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f7cb89a0-4a73-4a1b-bdf4-3a91b97d0f66", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "How is your detection portfolio?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "40fe1144-e98c-4070-af33-1a2d0bf54de0", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "2x2 matrix", "slug": "matrix-2x2", "status": "active", "bestFor": null, "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8", "version": 1, "bodyDocId": null, "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "7d99f91e-fa97-475e-883b-1d5caf017c40", "evidence": "Portfolio Scale, Fancy Dumpster, Not too bad..., Hot Garbage", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 22:14:14.77756+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [ { "matchId": "107e997c-4242-4bc6-bf9a-f70febf4aa13", "evidence": "A 4-stage progression scale for detection portfolio quality.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:05.103+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "frameworkName": "maturity-model" } ], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 19, "type": "analysis", "title": "Splunk dashboard interface showing RBA metrics.", "function": "summarize", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "balanced", "densityScore": 45, "componentCount": 7, "textChars": 152, "nDataPoints": 15, "notes": "Splunk dashboard interface showing RBA metrics.", "elementsJson": [ "big_number", "pie_chart", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.355+00", "seconds": 2.408, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/19", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-19", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.25, "w": 0.25, "x": 0.07, "y": 0.3 }, "kind": "chart", "text": "Adaptive Actions Overview", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "40955680-de08-4797-835e-743d4cc832eb", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.05, "x": 0.47, "y": 0.215 }, "kind": "metric", "text": "52", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c0fe7f2b-8153-4200-8fc9-18c23881bc2e", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Active Searches: 52", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-8ece2fe9450a", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.86, "x": 0.07, "y": 0.6 }, "kind": "table", "text": "Notable Events Without Risk table", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "14e7e40b-5b33-4c47-aa60-bac027897a2c", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.28, "x": 0.35, "y": 0.3 }, "kind": "table", "text": "Adaptive Actions Overview table", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1c2609e2-ece7-4d06-8d3a-45c4c0ad3315", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.28, "x": 0.64, "y": 0.3 }, "kind": "table", "text": "Risk Objects table", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "24982973-8cfd-48b3-a149-43bc6b1da5c2", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.2, "x": 0.06, "y": 0.13 }, "kind": "title", "text": "Getting Started with RBA", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.355+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "06b45c87-12fb-405c-98e8-289f0047dd05", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 20, "type": "analysis", "function": "present_solution", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "balanced", "densityScore": 38, "componentCount": 5, "textChars": 412, "nDataPoints": 5, "notes": null, "elementsJson": [ "headline_text", "paragraph", "screenshot", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.769+00", "seconds": 2.669, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/20", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-20", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Splunk® Enterprise Security offers a variety of Adaptive Actions that you can attach to your detections.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 15:55:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-d9f3-716a-8f83-23a82aecad13", "parentComponentId": null }, { "bbox": { "h": 0.895, "w": 0.65, "x": 0.32, "y": 0.085 }, "kind": "image", "text": "Laptop screen displaying the Adaptive Actions dashboard.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.769+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2981fc62-f7d9-4691-a33e-e8c28db27720", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.3, "x": 0.05, "y": 0.54 }, "kind": "subtitle", "text": "Splunk® Enterprise Security offers a variety of Adaptive Actions that you can attach to your detections.", "attrs": null, "canon": { "kind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "82d821ee-2793-42e7-8f16-c6131385a3ce", "version": 1, "description": "Header-zone supporting text near the title (= ex body.description with bbox)." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.769+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2a327034-69ca-4d75-a6ad-967faf18933a", "parentComponentId": null }, { "bbox": { "h": 0.53, "w": 0.65, "x": 0.32, "y": 0.085 }, "kind": "table", "text": "Adaptive Actions Overview table showing actions (slack, email, sendtophantom, notable, risk) and their respective counts.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.769+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b3b5d4c7-1820-42f9-a608-a1b6ffe34d32", "parentComponentId": null }, { "bbox": { "h": 0.16, "w": 0.285, "x": 0.05, "y": 0.235 }, "kind": "title", "text": "What are your Alerts doing?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.769+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0b7b410a-7e1c-4d83-acb5-c3b1bf0b5524", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "0723bef0-e2ba-4f58-a2d9-06b3499bb3d8", "evidence": "What are your Alerts doing?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.888311+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 20, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 21, "type": "analysis", "title": "The slide displays a table of risk rules and a summary metric bar for search complexity.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 6, "textChars": 226, "nDataPoints": 3, "notes": "The slide displays a table of risk rules and a summary metric bar for search complexity.", "elementsJson": [ "headline_text", "big_number", "data_table" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.73+00", "seconds": 2.388, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/21", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-21", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.05, "w": 0.05, "x": 0.89, "y": 0.25 }, "kind": "metric", "text": "24", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.73+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0ed0b315-5bc7-435b-9983-dbd859d250e4", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.05, "x": 0.74, "y": 0.25 }, "kind": "metric", "text": "18", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.73+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "83f6b4b9-d73c-4856-9b22-55e2c76e73a9", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.05, "x": 0.59, "y": 0.25 }, "kind": "metric", "text": "10", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.73+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d4623d87-6388-4c6d-bfd5-0638da8102c3", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Search Complexity: 52", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:38+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a4-fb793b6c6488", "parentComponentId": null }, { "bbox": { "h": 0.55, "w": 0.9, "x": 0.05, "y": 0.35 }, "kind": "table", "text": "Risk Rules table showing title, actions, risk_param, risk_object, risk_object_type, risk_score, search, index, sourcetype, datamodel, technique, tactics, data_source", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.73+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b81dcc78-1a12-4e29-8848-c61fda2e4152", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.45, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "What do your detections look like?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.73+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3a72a3ab-e13b-4f66-b807-b04c26ad27a1", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Data Story Arc", "slug": "data-story-arc", "status": "active", "bestFor": null, "canonId": "019dd956-9c30-728e-b974-d3fb123dcf5a", "version": 1, "bodyDocId": null, "description": "Context → Conflict → Insight → Implication structure for data narratives", "familyLabel": null, "categoryName": "Loop", "categorySlug": "loop" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "3c838ac9-51e8-41bc-af77-50f929bbcad4", "evidence": "What do your detections look like?", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:14.962969+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 21, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 22, "type": "analysis", "title": "The slide uses a laptop mockup to display a dashboard screenshot.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 5, "textChars": 382, "nDataPoints": 6, "notes": "The slide uses a laptop mockup to display a dashboard screenshot.", "elementsJson": [ "pie_chart", "screenshot" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.514+00", "seconds": 2.166, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/22", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-22", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Data is key to our success, so what are you doing with it?", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-1d2a2b87b309", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.3, "x": 0.55, "y": 0.3 }, "kind": "chart", "text": "Pie chart showing distribution of data sources: Endpoint, Network_Resolution, Risk, botsv2, Authentication, Change", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2e1de389-0619-4793-a792-9b3e0e2a753a", "parentComponentId": null }, { "bbox": { "h": 0.85, "w": 0.66, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop mockup showing a pie chart of Data Source Index Overview", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "15bd1e63-6343-4f6e-9576-7d7102e7d32f", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.05, "y": 0.45 }, "kind": "paragraph", "text": "Data is key to our success, so what are you doing with it? RBA Navigator App > Data Source > RBA Data Source Review", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "461c3b62-9819-42cb-bae4-eafa963ab765", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "What data sources are you using?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.514+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "90e23907-f88e-43b9-b835-5893f1611743", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Chart Selection Guide", "slug": "chart-selection-guide", "status": "active", "bestFor": null, "canonId": "019dd956-b1a0-700b-ba17-0e16c4d5bcae", "version": 1, "bodyDocId": null, "description": "Choosing the right chart type for your data and message", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "bed415aa-ddb2-472e-9f5e-ef07f19bed04", "evidence": "Pie chart showing distribution of data sources", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:15.036222+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 22, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 23, "type": "analysis", "title": "The slide uses a laptop graphic to display a table of unused indexes (azure, dlp, proxy).", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 36, "componentCount": 6, "textChars": 210, "nDataPoints": 3, "notes": "The slide uses a laptop graphic to display a table of unused indexes (azure, dlp, proxy).", "elementsJson": [ "headline_text", "paragraph", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.891+00", "seconds": 5.455, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/23", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-23", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It's a shame to waste good data...", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-74f8acc7be5b", "parentComponentId": null }, { "bbox": { "h": 0.89, "w": 0.67, "x": 0.32, "y": 0.08 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.891+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fb27d419-bfd8-4bdc-b87c-305c9d29149b", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.3, "x": 0.05, "y": 0.65 }, "kind": "list", "text": "RBA Navigator App > Data Source > RBA Data Source Review", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.891+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7a3ecc0c-8cf8-435d-8740-50d1ee94008e", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.05, "y": 0.5 }, "kind": "paragraph", "text": "It’s a shame to waste good data...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.891+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fcaede13-adcd-4a54-9aad-9565a179e18a", "parentComponentId": null }, { "bbox": { "h": 0.335, "w": 0.598, "x": 0.367, "y": 0.248 }, "kind": "table", "text": "Index Not Being Used by Program: azure, dlp, proxy", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.891+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3854b5e2-d235-45a4-823e-1fafacddf27d", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "What data sources are you NOT using?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.891+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c015d4be-8a30-4dde-984f-4fcd9a94e269", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Problem Statement Canvas", "slug": "problem-statement-canvas", "status": "active", "bestFor": null, "canonId": "019dd956-839d-744b-ad11-9bf3e3642a18", "version": 1, "bodyDocId": null, "description": "Structured definition of the problem: What? Who? Where? When? Scale?", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Architect", "layer": "slide", "agents": [ "Architect" ], "matchId": "59b6b477-3ca9-48e6-b0ac-cbb153a671b6", "evidence": "What data sources are you NOT using?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.6, "extraction": { "at": "2026-07-16 22:14:15.109251+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 23, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 24, "type": "setup", "title": "The slide features a collage-style illustration with a person, teddy bear, camera, plant, security camera, and butterfly against a bar chart background.", "function": "transition", "rawType": "section_divider", "block": null, "metadata": { "slideType": "section_divider", "slideTypeCanon": { "name": "Section divider", "slug": "section_divider", "status": "active", "canonId": "019de52d-066a-7402-9554-6ae504999041", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 23, "componentCount": 5, "textChars": 210, "nDataPoints": 0, "notes": "The slide features a collage-style illustration with a person, teddy bear, camera, plant, security camera, and butterfly against a bar chart background.", "elementsJson": [ "headline_text", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.681+00", "seconds": 2.221, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/24", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-24", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Strategy + Structure = Success!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:38+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-0b1d6d0d176c", "parentComponentId": null }, { "bbox": { "h": 0.92, "w": 0.5, "x": 0.044, "y": 0.064 }, "kind": "image", "text": "Collage illustration with person, teddy bear, camera, plant, security camera, butterfly, and bar chart background.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.681+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fb3d9ff4-ae97-4f6c-a32d-14720f5f135a", "parentComponentId": null }, { "bbox": { "h": 0.092, "w": 0.256, "x": 0.7, "y": 0.848 }, "kind": "image", "text": "Splunk .conf23 logo", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.681+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e974527f-c00f-4a8f-9930-e57556996f10", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.245, "x": 0.527, "y": 0.255 }, "kind": "title", "text": "Getting Started", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.681+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "92433273-ef9d-4cff-afaf-8ef008ca1ff4", "parentComponentId": null }, { "bbox": { "h": 0.028, "w": 0.285, "x": 0.527, "y": 0.483 }, "kind": "title", "text": "Strategy + Structure = Success!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.681+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a34836d2-3259-4b89-a4e9-34c6097298c4", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Section divider", "slug": "section-divider", "status": "active", "bestFor": null, "canonId": "019dd9e1-4c66-707d-8d1f-6e14547134c7", "version": 1, "bodyDocId": null, "description": "A transitional slide marking the start of a new section.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "aae08e9d-4121-4dfc-89ea-86bf77e3f25e", "evidence": "Strategy + Structure = Success!", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:15.182073+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 24, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 25, "type": "setup", "title": "Humorous engagement slide used during a presentation.", "function": "filler", "rawType": "filler", "block": null, "metadata": { "slideType": "filler", "slideTypeCanon": { "name": "Filler", "slug": "filler", "status": "active", "canonId": "019de52d-0829-76f9-9abe-4c11ee7bf4ab", "version": 1, "description": null }, "function": "filler", "functionCanon": { "name": "Filler", "slug": "filler", "status": "active", "canonId": "019de52d-1568-702b-ad12-428490978783", "version": 1, "description": null }, "density": "sparse", "densityScore": 10, "componentCount": 3, "textChars": 146, "nDataPoints": 0, "notes": "Humorous engagement slide used during a presentation.", "elementsJson": [ "headline_text", "icon_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:04.479+00", "seconds": 1.962, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/25", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-25", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.4, "w": 0.9, "x": 0.05, "y": 0.45 }, "kind": "list", "text": "A: r/oddlysatisfying, B: r/Nonononoyes, C: r/ATBGE, D: r/IdiotsFightingThings", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.479+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ad380d70-85b4-4cfd-8967-783fae6bfcf0", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.15, "x": 0.05, "y": 0.22 }, "kind": "paragraph", "text": "Poll Time", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.479+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "62325a9f-3e04-460e-8a07-50dea0027209", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.9, "x": 0.05, "y": 0.06 }, "kind": "title", "text": "Which Reddit community best describes your teams work style?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:04.479+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "26e10c3a-5b05-4c32-b9e1-3808bddd90cb", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "d4e9589d-b1e8-41b0-892a-70f3d1f276d2", "evidence": "Which Reddit community best describes your teams work style?", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:15.255761+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 26, "type": "analysis", "title": "The slide contrasts a table of 'Notable Events' with a line chart of 'Top 10 Notable Events' over time.", "function": "prioritize", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "prioritize", "functionCanon": { "name": "Prioritize", "slug": "prioritize", "status": "active", "canonId": "019de52d-1519-74b0-bca0-2b0217b641fa", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 6, "textChars": 269, "nDataPoints": 3, "notes": "The slide contrasts a table of 'Notable Events' with a line chart of 'Top 10 Notable Events' over time.", "elementsJson": [ "headline_text", "action_title", "data_table", "line_chart" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.449+00", "seconds": 2.838, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/26", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-26", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "You can't do it all at once!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 15:55:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-d9f3-716a-8f82-7dbb1eeba94c", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.4, "x": 0.58, "y": 0.45 }, "kind": "chart", "text": "Top 10 Notable Events line chart showing event frequency over time.", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.449+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7cc2e0d-be35-4c1f-b595-2097f9d72b9d", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Notable Events", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 15:55:37+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-d9f3-716a-8f82-80010c361076", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.55, "x": 0.02, "y": 0.45 }, "kind": "table", "text": "Notable Events Without Risk table showing Data Source, Severity, Tactic, Technique, and specific alert details.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.449+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d2b886d3-b913-4caf-bd05-9eec2b37c485", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.35, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Prioritize Your Work!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.449+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a01a6aaf-dd1e-4d32-8622-12ce9e6d6864", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.3, "x": 0.05, "y": 0.23 }, "kind": "title", "text": "You can't do it all at once!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.449+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "52429a37-ea0d-40ee-bf92-82c41fe76da0", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Data-Ink Ratio", "slug": "data-ink-ratio", "status": "active", "bestFor": null, "canonId": "019dd956-afc8-70da-b378-92834d36fde6", "version": 1, "bodyDocId": null, "description": "Maximize data, minimize non-data ink - remove chartjunk and decoration", "familyLabel": null, "categoryName": "Slide", "categorySlug": "slide" }, "agent": "Designer", "layer": "slide", "agents": [ "Designer" ], "matchId": "17e80fe6-1363-44c8-a55c-7c5afe3b48c8", "evidence": "table/data: Notable Events Without Risk table showing Data Source, Severity, Tactic, Technique, and specific alert details.", "pageRefs": null, "priority": "Core", "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:29.561481+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 27, "type": "appendix", "title": "The slide uses a simple multiplicative formula: Confidence x Impact = Risk Score.", "function": "present_framework", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_framework", "functionCanon": { "name": "Present framework", "slug": "present_framework", "status": "active", "canonId": "019de52d-1403-7667-9100-d2ac6709f750", "version": 1, "description": null }, "density": "dense", "densityScore": 53, "componentCount": 8, "textChars": 264, "nDataPoints": 1, "notes": "The slide uses a simple multiplicative formula: Confidence x Impact = Risk Score.", "elementsJson": [ "headline_text", "subtitle_text", "infographic" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:08.017+00", "seconds": 5.228, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/27", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-27", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Keeping it simple...", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-3f33941bc1cd", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.8, "x": 0.1, "y": 0.4 }, "kind": "diagram", "text": "Confidence (High) x Impact (High) = Risk Score (100)", "attrs": null, "canon": { "kind": { "name": "Diagram", "slug": "diagram", "status": "active", "canonId": "019de52c-f9f0-734a-81de-15382ff28c65", "version": 1, "description": "Schematic or relational diagram." }, "tool": null, "subkind": { "name": "Process flow", "slug": "process", "status": "active", "canonId": "019de52d-039c-718f-ad3a-efe9c4b3c838", "version": 1, "description": null }, "framework": null }, "subkind": "process", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f8266e7-ffb7-4508-992c-ffa24fc2ce01", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Risk Score: 100", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-438d910049ea", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.15, "x": 0.05, "y": 0.22 }, "kind": "paragraph", "text": "Keeping it simple...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3743cf2b-d614-4a0f-96be-7f395bd49877", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.38, "y": 0.75 }, "kind": "source-note", "text": "How bad would it be if this is a true positive?", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0bec79fc-f272-4a61-959a-2f48582f202c", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.08, "y": 0.75 }, "kind": "source-note", "text": "How sure are you the event is what you think it should be? FP vs TP", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "734e06b9-045c-4373-be20-c4b5f32ebb9d", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.7, "y": 0.75 }, "kind": "source-note", "text": "Score assigned to detection", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc77dd43-b8e7-4aae-85df-44de63f8d309", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.3, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "Basic Risk Score", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2bded438-0817-4fca-bb19-156640d0684f", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "2x2 matrix", "slug": "matrix-2x2", "status": "active", "bestFor": null, "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8", "version": 1, "bodyDocId": null, "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "4ff7abf7-f23b-4921-98a7-e4963ad6f196", "evidence": "diagram/process: Confidence (High) x Impact (High) = Risk Score (100)", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:29.623624+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [ { "matchId": "b61e2de1-d6ea-4f16-a17b-8275eb694ded", "evidence": "Formulaic representation of risk as a product of confidence and impact.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 17:04:08.017+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 27, "frameworkName": "Risk Scoring Model" } ], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 30, "from": 27, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699", "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.", "position": 1, "objective": "How can teams break down their risk score and detection portfolio?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:27:52.559685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 28, "type": "appendix", "title": "The slide displays a UI component for calculating risk scores based on detection rules, confidence, and impact levels.", "function": "present_solution", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 3, "textChars": 127, "nDataPoints": 3, "notes": "The slide displays a UI component for calculating risk scores based on detection rules, confidence, and impact levels.", "elementsJson": [ "headline_text", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.085+00", "seconds": 2.062, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/28", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-28", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.38, "w": 0.94, "x": 0.03, "y": 0.48 }, "kind": "image", "text": "UI screenshot of the Risk Score Calculator tool", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.085+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "57f8a3d9-d97f-4f36-876e-edf7c8e95e64", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.5, "x": 0.05, "y": 0.32 }, "kind": "paragraph", "text": "RBA Navigator App > Getting Started > Risk Score Calculator", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.085+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "678a6274-2eea-46ae-aad3-712faac978d8", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.4, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "Risk Score Calculator", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.085+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f5e008b-7de7-4550-aef7-64136fb47888", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 30, "from": 27, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699", "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.", "position": 1, "objective": "How can teams break down their risk score and detection portfolio?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:27:52.559685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 29, "type": "analysis", "title": "The diagram shows a complex web of security alerts (ESCU rules) connected to risk objects.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "sparse", "densityScore": 16, "componentCount": 4, "textChars": 180, "nDataPoints": 0, "notes": "The diagram shows a complex web of security alerts (ESCU rules) connected to risk objects.", "elementsJson": [ "headline_text", "bullet_list", "paragraph", "other" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.945+00", "seconds": 2.821, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/29", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-29", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.75, "w": 0.52, "x": 0.458, "y": 0.08 }, "kind": "chart", "text": "Advanced Analytics RBA Alerts by Risk Object", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Bubble chart", "slug": "bubble", "status": "active", "canonId": "019de52d-00a4-756f-8978-8d5e48905dbc", "version": 1, "description": null }, "framework": null }, "subkind": "bubble", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.945+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "79160850-c02f-4f9e-a07c-184a3e24f53a", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.05, "y": 0.3 }, "kind": "list", "text": "Check for:\n- CIM Compliant\n- Standard Formatting\n- Mislabeled Fields", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.945+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ff6540b5-2200-45f0-9fbb-f46b7846cf4d", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.4, "x": 0.05, "y": 0.65 }, "kind": "paragraph", "text": "RBA Navigator App > Getting Started > Detection Overview", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.945+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "781c0d59-850d-4c36-bd01-6a1806c87b0c", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.3, "x": 0.05, "y": 0.13 }, "kind": "title", "text": "Risk Objects", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.945+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "385d9a33-b042-41b8-9286-7284318fd0c3", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 30, "from": 27, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699", "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.", "position": 1, "objective": "How can teams break down their risk score and detection portfolio?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:27:52.559685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 30, "type": "appendix", "title": "The slide shows a list of technical fields (e.g., certificate_common_name, process_hash) and a UI snippet for configuring Risk Analysis in Splunk.", "function": "present_framework", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_framework", "functionCanon": { "name": "Present framework", "slug": "present_framework", "status": "active", "canonId": "019de52d-1403-7667-9100-d2ac6709f750", "version": 1, "description": null }, "density": "balanced", "densityScore": 32, "componentCount": 5, "textChars": 396, "nDataPoints": 0, "notes": "The slide shows a list of technical fields (e.g., certificate_common_name, process_hash) and a UI snippet for configuring Risk Analysis in Splunk.", "elementsJson": [ "headline_text", "bullet_list", "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:06.159+00", "seconds": 2.991, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/30", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-30", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.45, "w": 0.435, "x": 0.409, "y": 0.46 }, "kind": "image", "text": "Adaptive Response Actions UI", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.159+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "49775e02-7fcf-45ee-ba09-e44b95e22987", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.2, "x": 0.64, "y": 0.08 }, "kind": "list", "text": "http_user_agent, parent_process, parent_process_name, process, process_hash, process_name, registry_path, registry_value_name, registry_value_text, service, url", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.159+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5cfb4c36-a7e6-40b3-95d3-39f65715fbd0", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.2, "x": 0.42, "y": 0.08 }, "kind": "list", "text": "certificate_common_name, certificate_organization, certificate_serial, certificate_unit, command, domain, email, email_subject, file_hash, file_name", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.159+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6294c805-1e07-4570-988b-73bf3e26262c", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.05, "y": 0.53 }, "kind": "paragraph", "text": "| inputlookup common_threat_objects.csv", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.159+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c66c1667-156d-4374-ba42-966ff665ffaf", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "Common Threat Objects", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.159+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b5fcdcd6-bdce-4d79-a34e-ce761865635e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 30, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 15, "name": "Solution & Approach", "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Solution & Approach", "slug": "consultants-gambit-solution-approach", "status": "active", "canonId": "019dd9b8-071c-7161-9184-580fdac7a4f9", "version": 1, "description": null }, "evidence": "The deck provides a risk-based approach and strategy for success.", "position": 2, "isPrimaryArc": true, "parentBeatType": { "name": "Turn", "slug": "turn", "status": "active", "canonId": "019dd9b8-0396-702b-ac2f-9901f8dd8b54", "version": 1, "description": "The pivot — solution proposed, catalyst introduced, decision made. Common (15/20 arcs) but not universal: Triple-take, AIDA, PAS, Voyage-return and Pixar substitute it with a strong reflection or development beat." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [ { "to": 30, "from": 27, "loop": { "name": "40_mece_breakdown", "slug": "40-mece-breakdown", "status": "active", "bestFor": "Problem structuring, ensuring completeness, strategic analysis", "canonId": "019dd956-763c-765e-8b68-6ee3ae1ef184", "version": 1, "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21", "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage", "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories", "familyLabel": null }, "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699", "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.", "position": 1, "objective": "How can teams break down their risk score and detection portfolio?", "confidence": 0.6, "extraction": { "at": "2026-07-16 21:27:52.559685+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "locked": true }, { "page": 31, "type": "analysis", "title": "The slide shows technical configuration details for security monitoring rules.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 29, "componentCount": 4, "textChars": 362, "nDataPoints": 3, "notes": "The slide shows technical configuration details for security monitoring rules.", "elementsJson": [ "headline_text", "paragraph", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.608+00", "seconds": 4.331, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/31", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-31", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Should have the data you need to make quick decisions or follow a process!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-dae9dc92f903", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.5, "x": 0.05, "y": 0.23 }, "kind": "subtitle", "text": "Should have the data you need to make quick decisions or follow a process!", "attrs": null, "canon": { "kind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "82d821ee-2793-42e7-8f16-c6131385a3ce", "version": 1, "description": "Header-zone supporting text near the title (= ex body.description with bbox)." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.608+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ca735b32-c0f6-4c57-b858-5711709fd68c", "parentComponentId": null }, { "bbox": { "h": 0.55, "w": 0.98, "x": 0.01, "y": 0.385 }, "kind": "table", "text": "Table of Notable Events Without Risk showing columns for title, actions, severity, search, index, sourcetype, datamodel, data_source, tactics, technique, and data_source_listing.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.608+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4f22a64e-237f-4a5e-af9b-48c0c7ac682c", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.6, "x": 0.05, "y": 0.13 }, "kind": "title", "text": "Risk Incident Rules (Notable Events)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.608+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dd4b1274-e426-4f53-a464-8b62bf44aa7c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 32, "type": "setup", "function": "present_solution", "rawType": "initiative_list", "block": null, "metadata": { "slideType": "initiative_list", "slideTypeCanon": { "name": "Initiative list", "slug": "initiative_list", "status": "active", "canonId": "019de52d-0caf-770e-9b91-b99239121f50", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 2, "textChars": 313, "nDataPoints": 0, "notes": null, "elementsJson": [ "action_title", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.377+00", "seconds": 1.965, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/32", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-32", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.65, "w": 0.52, "x": 0.43, "y": 0.18 }, "kind": "list", "text": "High velocity over short period - 24 hour lookback range\nLow/Medium velocity over medium period - 7/14 day lookback range\nAny special requirements that need to be immediately addressed (compliance or incident response)\nAdvanced: Low velocity over long period - 15+ day lookback range", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.377+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e6e53571-36e3-4556-89c4-70c248942451", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "Risk Incident Rule Must Haves!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.377+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e564b0b7-7260-4b70-b897-925da505e74d", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 33, "type": "appendix", "function": "other", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 6, "componentCount": 2, "textChars": 142, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "bullet_list" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.603+00", "seconds": 2.036, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/33", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-33", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.4, "w": 0.5, "x": 0.43, "y": 0.2 }, "kind": "list", "text": "They will happen! See RBA GitHub Page: https://splunk.github.io/rba/searches/deduplicate_notables/ Two great options for help.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.603+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d6aa72a0-ed6e-443c-b401-c3061a4064f8", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "Duplicate Events", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.603+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5c0bfa35-f495-40fa-a0bb-4927d64189c1", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 34, "type": "setup", "title": "The slide uses a playful, non-traditional visual style typical of conference branding (Splunk .conf23).", "function": "transition", "rawType": "transition", "block": null, "metadata": { "slideType": "transition", "slideTypeCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-0693-7766-9f05-887f41f8e41e", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 1, "componentCount": 2, "textChars": 12, "nDataPoints": 0, "notes": "The slide uses a playful, non-traditional visual style typical of conference branding (Splunk .conf23).", "elementsJson": [ "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.966+00", "seconds": 2.341, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/34", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-34", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.85, "w": 0.45, "x": 0.04, "y": 0.1 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.966+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f646033a-59c2-4006-8900-2ac48c7a6f00", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.35, "x": 0.525, "y": 0.46 }, "kind": "title", "text": "Leveling Up!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.966+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "19c10422-025f-4c17-9ad0-652121d0c08d", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 35, "type": "appendix", "title": "The slide uses a maturity model framework to categorize teams into four distinct archetypes.", "function": "present_framework", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_framework", "functionCanon": { "name": "Present framework", "slug": "present_framework", "status": "active", "canonId": "019de52d-1403-7667-9100-d2ac6709f750", "version": 1, "description": null }, "density": "sparse", "densityScore": 10, "componentCount": 3, "textChars": 143, "nDataPoints": 0, "notes": "The slide uses a maturity model framework to categorize teams into four distinct archetypes.", "elementsJson": [ "headline_text", "icon_grid" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:06.249+00", "seconds": 2.563, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/35", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-35", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.35, "w": 0.9, "x": 0.05, "y": 0.45 }, "kind": "framework", "text": "A: Stuck in the Stone Age, B: Reluctant Reformers, C: Eager Evolvers, D: Agile Adapters", "attrs": null, "canon": { "kind": { "name": "Framework", "slug": "framework", "status": "active", "canonId": "019de52c-fa18-77c6-b10a-ccb8277ac0fa", "version": 1, "description": "Named conceptual framework instance." }, "tool": null, "subkind": { "name": "Framework instance", "slug": "instance", "status": "active", "canonId": "019de52d-05a2-72af-be0b-7edc60708a03", "version": 1, "description": null }, "framework": null }, "subkind": "instance", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.249+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "08eb176d-0859-4001-8f58-9c19f44123dd", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.05, "y": 0.06 }, "kind": "title", "text": "How important is program maturity to your team?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.249+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b5536233-f5df-4e0d-8af7-b99dd7077ba7", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.1, "x": 0.05, "y": 0.22 }, "kind": "title", "text": "Poll Time", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.249+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35345fda-3247-4312-8026-00b981959373", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "0e66e364-0b68-45f3-b435-5211a27f4145", "evidence": "Categorization of teams into four progressive stages of maturity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:06.249+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 35, "frameworkName": "maturity-model" } ], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 36, "type": "setup", "title": "The slide uses a visual equation to explain the risk scoring methodology.", "function": "present_framework", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "present_framework", "functionCanon": { "name": "Present framework", "slug": "present_framework", "status": "active", "canonId": "019de52d-1403-7667-9100-d2ac6709f750", "version": 1, "description": null }, "density": "dense", "densityScore": 66, "componentCount": 11, "textChars": 337, "nDataPoints": 1, "notes": "The slide uses a visual equation to explain the risk scoring methodology.", "elementsJson": [ "headline_text", "paragraph", "icon_grid", "other" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:11.925+00", "seconds": 8.14, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/36", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-36", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.1, "w": 0.2, "x": 0.29, "y": 0.77 }, "kind": "list", "text": "Impact: How bad would it be if this is a true positive?", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5c954531-a000-42b1-9142-648add25259c", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.53, "y": 0.77 }, "kind": "list", "text": "MITRE ATT&CK / Disposition Trending: How important is the TTP and/or are events trending TP/FP", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "787b80fa-68d0-45a1-a682-a04b4a0eff68", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.05, "y": 0.77 }, "kind": "list", "text": "Confidence: How sure are you the event is what you think it should be? FP vs TP", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9a71ab30-26ea-4694-8833-3a78d1032472", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.2, "x": 0.77, "y": 0.77 }, "kind": "list", "text": "Risk Score: Risk Score assigned to event", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f963144c-7a43-4645-b83f-f5c914f5c586", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.31, "y": 0.48 }, "kind": "metric", "text": "High", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1176563c-b733-4d2b-be74-154ea70fbb85", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.55, "y": 0.48 }, "kind": "metric", "text": "1.5", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "379fb7fe-a556-433b-b0b1-c6d4596de398", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.07, "y": 0.48 }, "kind": "metric", "text": "Medium", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3fd354bb-93f8-44ed-8aef-c5ef06663168", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.15, "x": 0.79, "y": 0.48 }, "kind": "metric", "text": "85", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": null, "subkind": { "name": "Big number", "slug": "big-number", "status": "active", "canonId": "019de52c-fc70-70c8-b965-0584548a9204", "version": 1, "description": null }, "framework": null }, "subkind": "big-number", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "456dab18-aae6-4f7f-bc0c-b8c806cc56f4", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Risk Score: 85", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-a7ca529bc032", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.2, "x": 0.05, "y": 0.21 }, "kind": "paragraph", "text": "Let's do some math...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "af6aefd9-bcad-43c9-8f20-0d79f0013d16", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.35, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "Advanced Risk Score", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "68078d8a-6492-4d50-8773-05a11f5c9eca", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "ab87d66b-bd58-4c45-845f-7b2bec6a3161", "evidence": "Formulaic representation of risk score components", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 17:04:11.925+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 36, "frameworkName": "Risk Scoring Model" } ], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 37, "type": "analysis", "title": "The visualization uses a force-directed graph layout to map security rules (ESCU/Threat-RN) and their relationships to entities like 'user', 'dest', and 'src'.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 9, "componentCount": 3, "textChars": 124, "nDataPoints": 0, "notes": "The visualization uses a force-directed graph layout to map security rules (ESCU/Threat-RN) and their relationships to entities like 'user', 'dest', and 'src'.", "elementsJson": [ "headline_text", "paragraph", "flowchart" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:06.319+00", "seconds": 2.527, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/37", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-37", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.7, "w": 0.5, "x": 0.45, "y": 0.15 }, "kind": "chart", "text": "Network graph of security detection rules", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Dot plot", "slug": "dot", "status": "active", "canonId": "019de52d-0235-738b-bd2b-78f8e24d7cb0", "version": 1, "description": null }, "framework": null }, "subkind": "dot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.319+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "59ba5000-cb7d-461d-bf8f-67ac758653ff", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.05, "y": 0.5 }, "kind": "paragraph", "text": "RBA Navigator App > Getting Started > Detection Overview", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.319+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5c73e31f-f793-484b-85c4-970e4c1d0867", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.35, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Risk Incident Rule Coverage", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.319+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7ae734d3-d68c-470c-8e21-e06cb470d525", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Network Effects Flywheel", "slug": "network-effects-flywheel", "status": "active", "bestFor": null, "canonId": "79fa8d3e-ef02-4ee8-ad12-f8e00a25cca1", "version": 1, "bodyDocId": null, "description": null, "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "251e9dbb-b83b-40b8-9eed-a1c34db4baf2", "evidence": "chart/dot: Network graph of security detection rules", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.5, "extraction": { "at": "2026-07-16 22:14:29.96681+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 37, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 38, "type": "analysis", "title": "The slide uses a sidebar layout with a thematic illustration.", "function": "diagnose", "rawType": "diagnosis", "block": null, "metadata": { "slideType": "diagnosis", "slideTypeCanon": { "name": "Diagnosis", "slug": "diagnosis", "status": "active", "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "balanced", "densityScore": 30, "componentCount": 5, "textChars": 355, "nDataPoints": 0, "notes": "The slide uses a sidebar layout with a thematic illustration.", "elementsJson": [ "headline_text", "bullet_list", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:06.819+00", "seconds": 2.889, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/38", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-38", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Have a process in place to address these ASAP.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:39+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-c27ff47c97da", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.45, "x": 0.42, "y": 0.26 }, "kind": "list", "text": "Do you need to filter out noise?\nAdjust risk score?\nIs the detection working correctly?\nHave a group trained so action can be taken quickly!", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.819+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c3e40df6-c472-40e2-9653-fa88376e87c9", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.45, "x": 0.42, "y": 0.21 }, "kind": "paragraph", "text": "Have a process in place to address these ASAP.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.819+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6d171e80-ac6e-4356-a141-19b13eed4705", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.45, "x": 0.42, "y": 0.52 }, "kind": "paragraph", "text": "Advanced: have a dynamic risk score matrix to adjust risk score based on alert disposition trending.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.819+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "caa6add7-0a5d-41fa-8efc-799bcb0b7b22", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.25, "x": 0.05, "y": 0.12 }, "kind": "title", "text": "False Positives Happen!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.819+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9ce9a5d3-f68b-4e52-856d-419c5119da8c", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Problem-Agitate-Solve (PAS)", "slug": "problem-agitate-solve-pas", "status": "active", "bestFor": null, "canonId": "019dd956-869f-7564-8d42-de54ed29ab90", "version": 1, "bodyDocId": null, "description": "Identify problem, agitate the pain, present the solution", "familyLabel": null, "categoryName": "Block", "categorySlug": "block" }, "agent": "Storyteller", "layer": "slide", "agents": [ "Storyteller" ], "matchId": "009c0839-24f7-4cd3-9fbf-917e4a2b8699", "evidence": "The slide presents a problem (False Positives Happen!), agitates it by asking questions and suggesting actions, and implies a solution (having a process in place to address these ASAP).", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:04.907787+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 38, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 39, "type": "analysis", "title": "The chart shows a repetitive pattern of events over time, likely indicating a need for tuning as suggested by the text.", "function": "diagnose", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 4, "textChars": 132, "nDataPoints": 0, "notes": "The chart shows a repetitive pattern of events over time, likely indicating a need for tuning as suggested by the text.", "elementsJson": [ "headline_text", "bullet_list", "line_chart", "screenshot" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:05.966+00", "seconds": 1.973, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/39", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-39", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.8, "w": 0.6, "x": 0.36, "y": 0.08 }, "kind": "chart", "text": "Top 10 Notable Events", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.966+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a5c067d4-8e09-49f0-a741-c609a3289b30", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.3, "x": 0.05, "y": 0.3 }, "kind": "list", "text": "Is tuning needed?\nDoes Risk Score make sense?\nThink about dynamic volume score.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.966+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e3a0cf2d-7df9-40c4-bb27-54bc6827d10c", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Notable Events", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:42+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a6-a4c55c5d3bdb", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.25, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Detection Velocity", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:05.966+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "560ff458-9909-4713-b7db-2513c05dc0e1", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 40, "type": "setup", "title": "The slide uses a laptop graphic to frame the comparison data.", "function": "compare_options", "rawType": "comparison_table", "block": null, "metadata": { "slideType": "comparison_table", "slideTypeCanon": { "name": "Comparison table", "slug": "comparison_table", "status": "active", "canonId": "019de52d-0a06-73f8-8813-fe022fab1de2", "version": 1, "description": null }, "function": "compare_options", "functionCanon": { "name": "Compare options", "slug": "compare_options", "status": "active", "canonId": "019de52d-167f-7038-aebc-70a9d2e0e33b", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 6, "textChars": 233, "nDataPoints": 2, "notes": "The slide uses a laptop graphic to frame the comparison data.", "elementsJson": [ "headline_text", "bullet_list", "screenshot", "big_number" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:09.916+00", "seconds": 5.699, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/40", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-40", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Data Models offer great search performance!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:40+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-edc1806068e6", "parentComponentId": null }, { "bbox": { "h": 0.4, "w": 0.6, "x": 0.36, "y": 0.21 }, "kind": "chart", "text": "datamodel_search: 49, index_search: 7", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Horizontal bar chart", "slug": "bar-horizontal", "status": "active", "canonId": "019de52c-fec4-7221-986b-1cb5f5e84b1f", "version": 1, "description": null }, "framework": null }, "subkind": "bar-horizontal", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.916+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "43399554-4925-4930-a45f-147d966e3c20", "parentComponentId": null }, { "bbox": { "h": 0.9, "w": 0.68, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop graphic", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.916+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2c0f5b6a-9f89-4b55-9b27-a180ec729d6b", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.28, "x": 0.05, "y": 0.35 }, "kind": "list", "text": "Data Models offer great search performance! They also require careful setup and maintenance", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.916+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d27d5516-1f2f-4cca-992e-6655239631b0", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Search performance: 49", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:40+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a5-f198b845aa2f", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.28, "x": 0.05, "y": 0.07 }, "kind": "title", "text": "Data Model vs Index search", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.916+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "828c937c-2a4d-4376-b692-d2eb1fb7d106", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Comparison frame", "slug": "comparison-frame", "status": "active", "bestFor": null, "canonId": "019dd9e1-484b-7399-a4fc-d14644b99f93", "version": 1, "bodyDocId": null, "description": "Two or more states/subjects placed side by side to expose a gap.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "6bbc3de0-edf5-4e84-8e25-e509b275d8e5", "evidence": "The slide compares data model vs index search performance using a bar chart and bullet points.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:05.018115+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 40, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 41, "type": "appendix", "title": "The slide includes a URL to the Splunkbase app page and a screenshot of a data model table.", "function": "present_solution", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 5, "textChars": 292, "nDataPoints": 0, "notes": "The slide includes a URL to the Splunkbase app page and a screenshot of a data model table.", "elementsJson": [ "headline_text", "action_title", "data_table", "paragraph" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:09.709+00", "seconds": 5.365, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/41", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-41", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "If you use Data Models, you need this app!!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 15:55:38+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-d9f3-716a-8f82-ebf1a77d8eb4", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.05, "y": 0.82 }, "kind": "paragraph", "text": "https://splunkbase.splunk.com/app/6430", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.709+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e42335ba-22e4-4144-a5ea-ca5d708d803a", "parentComponentId": null }, { "bbox": { "h": 0.78, "w": 0.68, "x": 0.31, "y": 0.115 }, "kind": "table", "text": "Data Model Details table showing columns: datamodel, lineage, dataset, macro_name, macro_indexes, tags, extracted_fields, calculated_fields", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.709+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a87e591c-ccd3-413d-9336-2e7d10cb5d92", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.3, "x": 0.05, "y": 0.53 }, "kind": "title", "text": "If you use Data Models, you need this app!!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.709+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f4fcd35e-2366-474d-b0f0-1722fb743809", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.3, "x": 0.05, "y": 0.25 }, "kind": "title", "text": "Outpost - Data Model Mechanic", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:09.709+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6ad5c8e5-2c79-4bf4-b014-62433bc9e1b8", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Call to action", "slug": "call-to-action", "status": "active", "bestFor": null, "canonId": "019dd9e1-4bbb-702a-9ead-82daf188bb7c", "version": 1, "bodyDocId": null, "description": "Explicit prescription of what the audience should do next.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "8c6b9b53-3809-413a-801e-e624a10ecb00", "evidence": "The slide has a clear call-to-action title 'If you use Data Models, you need this app!!' and provides a link.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.8, "extraction": { "at": "2026-07-16 22:14:05.093508+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 41, "whyItWorks": null, "antipattern": null, "cardinality": "common", "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 42, "type": "analysis", "title": "The table highlights specific security rules that are failing to trigger or record events.", "function": "diagnose", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "diagnose", "functionCanon": { "name": "Diagnose", "slug": "diagnose", "status": "active", "canonId": "019de52d-1657-7223-acc5-7437d878c850", "version": 1, "description": null }, "density": "sparse", "densityScore": 24, "componentCount": 4, "textChars": 216, "nDataPoints": 12, "notes": "The table highlights specific security rules that are failing to trigger or record events.", "elementsJson": [ "headline_text", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:06.875+00", "seconds": 2.472, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/42", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-42", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "metric", "text": "total_events", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:42+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a6-d246e18118f8", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.05, "y": 0.85 }, "kind": "paragraph", "text": "RBA Navigator App > Data Source > RBA Data Source Review", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.875+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3cd964d0-f2b0-4c11-ae8e-a0eb60d49089", "parentComponentId": null }, { "bbox": { "h": 0.7, "w": 0.6, "x": 0.375, "y": 0.13 }, "kind": "table", "text": "Risk Data Source Event Overview table with columns: title, mitre_technique, mitre_tactic, first_seen, last_seen, total_events", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.875+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "73c3bdcb-528d-46f6-ab69-538b9d450f6c", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.3, "x": 0.05, "y": 0.35 }, "kind": "title", "text": "Sometimes things break!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:06.875+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4b64ff28-ba78-42c8-8b07-6faf00588e84", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 43, "type": "analysis", "title": "The slide uses a laptop mockup to display three pie charts representing cybersecurity coverage metrics.", "function": "present_solution", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "present_solution", "functionCanon": { "name": "Present solution", "slug": "present_solution", "status": "active", "canonId": "019de52d-15b8-71da-bd23-2b767850cbce", "version": 1, "description": null }, "density": "dense", "densityScore": 53, "componentCount": 7, "textChars": 342, "nDataPoints": 18, "notes": "The slide uses a laptop mockup to display three pie charts representing cybersecurity coverage metrics.", "elementsJson": [ "headline_text", "paragraph", "screenshot", "pie_chart" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.615+00", "seconds": 2.972, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/43", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-43", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Tracking these ttp's is a huge undertaking and a must have for most organizations.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:40+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a6-16bbe63b66b5", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.28, "x": 0.36, "y": 0.12 }, "kind": "chart", "text": "ID Overview pie chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2b4aa0e3-1294-4b87-83a8-8ab273808895", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.28, "x": 0.65, "y": 0.12 }, "kind": "chart", "text": "Tactic Overview pie chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "36b0ad55-3e69-440e-b701-f30c0c5a3af5", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.28, "x": 0.48, "y": 0.45 }, "kind": "chart", "text": "Technique Overview pie chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c5d5c263-39cb-443e-9133-27d29c42e732", "parentComponentId": null }, { "bbox": { "h": 0.9, "w": 0.67, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop mockup", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7cd69bf-646b-4dbd-a825-04994e69faab", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.3, "x": 0.05, "y": 0.45 }, "kind": "paragraph", "text": "Tracking these ttp's is a huge undertaking and a must have for most organizations. RBA Navigator App > Data Source > RBA Data Source Review", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "78e1d949-dc98-43fc-b811-18747c5ea47f", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.3, "x": 0.05, "y": 0.07 }, "kind": "title", "text": "How is your MITRE ATT&CK coverage?", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c5641986-15ad-4ad6-886b-639ea370e887", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "49fc30ec-a7ef-40fc-9209-6ac325fc66e4", "evidence": "Explicit mention of MITRE ATT&CK coverage in title and body.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 17:04:07.615+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 43, "frameworkName": "MITRE ATT&CK" } ], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 44, "type": "analysis", "title": "The slide uses network diagrams to visualize alert coverage across the MITRE framework.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 22, "componentCount": 5, "textChars": 174, "nDataPoints": 0, "notes": "The slide uses network diagrams to visualize alert coverage across the MITRE framework.", "elementsJson": [ "headline_text", "flowchart" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.367+00", "seconds": 2.682, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/44", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-44", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.5, "w": 0.4, "x": 0.52, "y": 0.4 }, "kind": "chart", "text": "Network diagram of alerts by technique", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Dot plot", "slug": "dot", "status": "active", "canonId": "019de52d-0235-738b-bd2b-78f8e24d7cb0", "version": 1, "description": null }, "framework": null }, "subkind": "dot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "27c9c0ab-cc1f-4ddb-963a-9cc32982b3b3", "parentComponentId": null }, { "bbox": { "h": 0.5, "w": 0.4, "x": 0.05, "y": 0.4 }, "kind": "chart", "text": "Network diagram of alerts by tactic", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Dot plot", "slug": "dot", "status": "active", "canonId": "019de52d-0235-738b-bd2b-78f8e24d7cb0", "version": 1, "description": null }, "framework": null }, "subkind": "dot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "995cfd65-ec56-4054-aaea-7ec50f8f5932", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.4, "x": 0.05, "y": 0.13 }, "kind": "title", "text": "MITRE ATT&CK Density", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3257e9dc-ab29-4a19-930b-f95f8bcef7a3", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.35, "x": 0.05, "y": 0.31 }, "kind": "title", "text": "Advanced Analytics RBA Alerts by Tactic", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "40a59741-9759-42e3-b6d3-9ded1c8227ab", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.35, "x": 0.52, "y": 0.31 }, "kind": "title", "text": "Advanced Analytics RBA Alerts by Technique", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d9d5b83d-72bc-40a8-b83c-334d47393bbc", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "a08933e7-3d07-48d0-bb26-d00778918a4e", "evidence": "Slide title and content reference MITRE ATT&CK framework", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 17:04:07.367+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 44, "frameworkName": "MITRE ATT&CK" } ], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 45, "type": "analysis", "title": "Screenshot of a Splunk interface for CIM compliance validation.", "function": "analyze_data", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 21, "componentCount": 4, "textChars": 131, "nDataPoints": 15, "notes": "Screenshot of a Splunk interface for CIM compliance validation.", "elementsJson": [ "headline_text", "subtitle_text", "screenshot", "data_table" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.311+00", "seconds": 2.577, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/45", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-45", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "CIM made easy!", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 15:55:50+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-d9f3-716a-8f84-8bc917e238b5", "parentComponentId": null }, { "bbox": { "h": 0.5, "w": 0.9, "x": 0.05, "y": 0.335 }, "kind": "table", "text": "CIM Compliance Check table showing cim_field, total_data_models, and data_models columns.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2c9d173f-2cb9-433f-b77d-700aee5f4ada", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.39, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "CIM Compliance", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0cc324bd-1c8c-4c78-a7e4-34c0f07beec1", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.22, "x": 0.05, "y": 0.21 }, "kind": "title", "text": "CIM made easy!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.311+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c565e4a1-b226-41fd-82e0-98e2d2abe1bc", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 46, "type": "analysis", "title": "The slide shows technical Splunk SPL queries mapped to security tactics and techniques.", "function": "analyze_data", "rawType": "data_table", "block": null, "metadata": { "slideType": "data_table", "slideTypeCanon": { "name": "Data table", "slug": "data_table", "status": "active", "canonId": "019de52d-0bbd-71b9-9918-417f904abbf8", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 17, "componentCount": 3, "textChars": 138, "nDataPoints": 15, "notes": "The slide shows technical Splunk SPL queries mapped to security tactics and techniques.", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.107+00", "seconds": 2.351, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/46", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-46", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.45, "w": 0.9, "x": 0.05, "y": 0.42 }, "kind": "table", "text": "Risk Object CIM Check table with columns: search, actions, title, tactics, technique, risk_object, cim_data_model", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.107+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "58402690-beea-4b1e-8d32-c6ed6c9361e7", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.39, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "CIM Compliance", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.107+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f42ab7e3-0ed1-45f8-ada3-0d799c9b4cc6", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.18, "x": 0.05, "y": 0.21 }, "kind": "title", "text": "CIM checker", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.107+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "473720c1-f931-4de7-94d6-e59a3b9b7ec4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 47, "type": "analysis", "title": "The slide displays a screenshot of a software interface (RBA Navigator App) within a laptop frame.", "function": "summarize", "rawType": "kpi_dashboard", "block": null, "metadata": { "slideType": "kpi_dashboard", "slideTypeCanon": { "name": "KPI dashboard", "slug": "kpi_dashboard", "status": "active", "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "balanced", "densityScore": 31, "componentCount": 5, "textChars": 187, "nDataPoints": 24, "notes": "The slide displays a screenshot of a software interface (RBA Navigator App) within a laptop frame.", "elementsJson": [ "headline_text", "paragraph", "screenshot", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:10.931+00", "seconds": 6.067, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/47", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-47", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.9, "w": 0.68, "x": 0.32, "y": 0.08 }, "kind": "image", "text": "Laptop frame containing the dashboard", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:10.931+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "03629523-c832-411c-a11d-b42c60b3a348", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "risk_score: 100", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:40+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a6-2c6bf29a9433", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.28, "x": 0.05, "y": 0.46 }, "kind": "paragraph", "text": "RBA Navigator App > Getting Started > Detection Overview", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:10.931+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5c296350-d5c6-4907-b9dd-5c551eeccc6e", "parentComponentId": null }, { "bbox": { "h": 0.48, "w": 0.6, "x": 0.36, "y": 0.18 }, "kind": "table", "text": "Table showing risk_score, count, and title of security rules", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:10.931+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "61964d97-70fc-48db-abde-edd1225fc20e", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.28, "x": 0.05, "y": 0.26 }, "kind": "title", "text": "Risk Score Overview", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:10.931+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "73709463-2847-4d0f-96f4-367d4537f23c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 48, "type": "setup", "title": "The slide features a whimsical, surreal collage of people, objects, and cityscapes, typical of Splunk's brand identity.", "function": "other", "rawType": "closing_ask", "block": null, "metadata": { "slideType": "closing_ask", "slideTypeCanon": { "name": "Closing ask", "slug": "closing_ask", "status": "active", "canonId": "019de52d-0aa4-750f-8aa1-8d622dd99f5c", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 10, "componentCount": 4, "textChars": 40, "nDataPoints": 0, "notes": "The slide features a whimsical, surreal collage of people, objects, and cityscapes, typical of Splunk's brand identity.", "elementsJson": [ "headline_text" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.48+00", "seconds": 2.47, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/48", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-48", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.5, "w": 0.9, "x": 0.05, "y": 0.4 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.48+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9e1bffae-8912-4faf-88bb-799d97af0fdb", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.13, "x": 0.85, "y": 0.93 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.48+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "af889034-7291-4200-b089-4544cde348cb", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.07, "x": 0.92, "y": 0.01 }, "kind": "other", "text": "© 2023 SPLUNK INC.", "attrs": null, "canon": { "kind": { "name": "Other", "slug": "other", "status": "active", "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d", "version": 1, "description": "Fallback when no canonical kind applies." }, "tool": null, "subkind": { "name": "Unclassified", "slug": "unclassified", "status": "active", "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0", "version": 1, "description": null }, "framework": null }, "subkind": "unclassified", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.48+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fcc6220c-5de8-4340-9212-61228112ebf9", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.73, "x": 0.135, "y": 0.15 }, "kind": "title", "text": "Questions and Answers!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.48+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c38c091d-90b3-427e-9cac-c4dcc487c35e", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Storytelling: the closing ask", "slug": "closing-ask", "status": "active", "bestFor": null, "canonId": "019df269-24e0-70ab-8dd9-983832c1c665", "version": 1, "bodyDocId": "019df269-24bc-7554-b88d-245127606b8d", "description": "The single most important slide in the deck — after the cover. The final", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "0f9ef7ed-7514-4f97-a021-f3ee6a7390e8", "evidence": "The slide has a clear closing ask title 'Questions and Answers!'.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:05.387789+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 48, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 49, "type": "resolution", "function": "summarize", "rawType": "key_takeaways", "block": null, "metadata": { "slideType": "key_takeaways", "slideTypeCanon": { "name": "Key takeaways", "slug": "key_takeaways", "status": "active", "canonId": "019de52d-06e7-7674-a891-9f7de3b11b6d", "version": 1, "description": null }, "function": "summarize", "functionCanon": { "name": "Summarize", "slug": "summarize", "status": "active", "canonId": "019de52d-1541-704f-b86f-bf7b75056373", "version": 1, "description": null }, "density": "balanced", "densityScore": 29, "componentCount": 6, "textChars": 157, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.395+00", "seconds": 2.381, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/49", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-49", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.1, "w": 0.15, "x": 0.55, "y": 0.45 }, "kind": "list", "text": "Progress vs Perfection", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "637911e9-3d7a-4b1e-aa23-1d5b2751c8c6", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.78, "y": 0.45 }, "kind": "list", "text": "Make RBA Yours!", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "74bdeb22-9f8c-46b4-9710-fc169992198a", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.28, "y": 0.45 }, "kind": "list", "text": "Structure + Strategy = Success!", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b0fcc3ca-a7f4-42c5-a0fe-5945d402947b", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.15, "x": 0.06, "y": 0.45 }, "kind": "list", "text": "Knowing is half the battle...", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b1a71747-fac0-4c0c-98f6-8de1b3e4de2e", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.6, "x": 0.05, "y": 0.15 }, "kind": "title", "text": "Things I wish I knew earlier...", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5ef304ea-9016-420b-b42d-d35b8b88f428", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.3, "x": 0.05, "y": 0.23 }, "kind": "title", "text": "Why didn't I think of that...", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Subtitle", "slug": "subtitle", "status": "active", "canonId": "019de52c-fb09-739d-900c-815b0d9ac526", "version": 1, "description": null }, "framework": null }, "subkind": "subtitle", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.395+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc5bf3a0-e272-4753-b61f-4e6c2481a889", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 50, "type": "evidence", "title": "The slide serves as a promotional announcement for a specific software tool.", "function": "illustrate_case", "rawType": "client_example", "block": null, "metadata": { "slideType": "client_example", "slideTypeCanon": { "name": "Client example", "slug": "client_example", "status": "active", "canonId": "019de52d-0c87-77cb-9867-613ae22e95ac", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 5, "textChars": 288, "nDataPoints": 0, "notes": "The slide serves as a promotional announcement for a specific software tool.", "elementsJson": [ "headline_text", "screenshot", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.327+00", "seconds": 2.307, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/50", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-50", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "RBA Navigator is a powerful tool designed to elevate the capabilities of IT security teams by going beyond the conventional approach of risk-based alerting.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-27 07:18:41+00", "model": "or:google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd952-832b-73b4-83a6-45e5b1234c76", "parentComponentId": null }, { "bbox": { "h": 0.58, "w": 0.92, "x": 0.04, "y": 0.28 }, "kind": "image", "text": "Splunkbase application page for RBA Navigator", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.327+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8c4ac743-38d3-4639-b66c-f1612dbfa337", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.45, "x": 0.01, "y": 0.95 }, "kind": "paragraph", "text": "RBA Navigator: https://splunkbase.splunk.com/app/6903", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.327+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1e227b99-01b6-4343-9ebf-2b85a61ab21f", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.25, "x": 0.05, "y": 0.21 }, "kind": "paragraph", "text": "Now on Splunkbase™!!!", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.327+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "26ad591e-e3bf-480f-b704-3e6d16aadd31", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.35, "x": 0.05, "y": 0.14 }, "kind": "title", "text": "RBA Navigator", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.327+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d9a50e8-6133-47bd-a7a2-3860ee3ff9ee", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Storytelling: audience calibration", "slug": "audience", "status": "active", "bestFor": null, "canonId": "019df269-23ea-723a-87c0-af1d78d702d2", "version": 1, "bodyDocId": "019df269-23c5-72ec-8b94-78fc1da7b656", "description": "The same thesis, written for four different audiences, produces four", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "3a8af1e2-bde7-4ef2-a22e-afd7bd07d53c", "evidence": "RBA Navigator is a powerful tool designed to elevate the capabilities of IT security teams by going beyond the conventional approach of risk-based alerting.", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.7, "extraction": { "at": "2026-07-16 22:14:05.878942+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 50, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 51, "type": "appendix", "function": "other", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 2, "textChars": 638, "nDataPoints": 0, "notes": null, "elementsJson": [ "headline_text", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.527+00", "seconds": 2.228, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/51", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-51", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.55, "w": 0.9, "x": 0.06, "y": 0.33 }, "kind": "list", "text": "RBA Navigator: https://splunkbase.splunk.com/app/6903\nRBA Community\n- Wakelet site: https://wakelet.com/wake/rqjxuE9hXsCJRwWXsuHr1\n- Outpost Security Slack Channel: https://outpost-security.com/slack\n- Community Website: https://rba.community\n.conf Talks: https://conf.splunk.com/watch/conf-online.html?search=RBA\nRBA Book by Haylee Mills: https://www.splunk.com/en_us/form/the-essential-guide-to-risk-based-alerting.html\nGitHub: https://github.com/splunk/rba/\nFind me:\n- LinkedIn: https://www.linkedin.com/in/matthew-snyder-48b39987/\n- Outpost Security Slack: @Matt Snyder\n- GitHub: https://github.com/matt-snyder-stuff", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.527+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0a61e834-2938-4302-863b-696cce907a13", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.45, "x": 0.05, "y": 0.13 }, "kind": "title", "text": "Awesome Resources!", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.527+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0408603c-4713-4422-86c6-0d5c2a870c3b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 52, "type": "setup", "title": "This is a standard closing slide for a Splunk conference presentation.", "function": "transition", "rawType": "closing_ask", "block": null, "metadata": { "slideType": "closing_ask", "slideTypeCanon": { "name": "Closing ask", "slug": "closing_ask", "status": "active", "canonId": "019de52d-0aa4-750f-8aa1-8d622dd99f5c", "version": 1, "description": null }, "function": "transition", "functionCanon": { "name": "Transition", "slug": "transition", "status": "active", "canonId": "019de52d-1365-7149-92aa-66df859e75fd", "version": 1, "description": null }, "density": "sparse", "densityScore": 7, "componentCount": 3, "textChars": 78, "nDataPoints": 0, "notes": "This is a standard closing slide for a Splunk conference presentation.", "elementsJson": [ "headline_text", "photo", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 17:04:07.535+00", "seconds": 2.018, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/52", "deck": "/decks/019dd923-5eff-723e-9be5-920f70c17c85", "deckAnchor": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-52", "deckJson": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json" }, "components": [ { "bbox": { "h": 0.5, "w": 1, "x": 0, "y": 0.4 }, "kind": "image", "text": "Collage of landmarks, people, and surreal elements", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "29dfc983-fbbd-431d-872d-57bd84c48c5c", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.14, "x": 0.85, "y": 0.92 }, "kind": "image", "text": "Splunk .conf23 logo", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a22b2e97-32a9-4cf5-bd37-f93b06b7c47f", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.52, "x": 0.24, "y": 0.18 }, "kind": "title", "text": "Thank You", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 17:04:07.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ed60547a-af2d-4218-b6a8-c7c6e524e00b", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Storytelling: the closing ask", "slug": "closing-ask", "status": "active", "bestFor": null, "canonId": "019df269-24e0-70ab-8dd9-983832c1c665", "version": 1, "bodyDocId": "019df269-24bc-7554-b88d-245127606b8d", "description": "The single most important slide in the deck — after the cover. The final", "familyLabel": "narrative-block", "categoryName": "Narrative & Transformation", "categorySlug": "narrative-transformation" }, "agent": "storyteller", "layer": "slide", "agents": [ "storyteller" ], "matchId": "ff096be4-0aaa-4630-ad28-0374dfc57bcc", "evidence": "Thank You", "pageRefs": null, "priority": null, "whenToUse": null, "confidence": 0.9, "extraction": { "at": "2026-07-16 22:14:05.998378+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 52, "whyItWorks": null, "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [ { "to": 52, "arc": { "name": "The Consultant's Gambit", "slug": "consultants-gambit", "status": "active", "bestFor": "Business cases, project proposals, strategic recommendations", "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps", "description": null, "familyLabel": null }, "from": 31, "name": "Impact & Next Steps", "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335", "matchId": "1d61d37b-aea3-42f9-a4d9-83efac1c274f", "beatType": { "name": "Impact & Next Steps", "slug": "consultants-gambit-impact-next-steps", "status": "active", "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655", "version": 1, "description": null }, "evidence": "The deck concludes with key takeaways, a client example, and a call to action.", "position": 3, "isPrimaryArc": true, "parentBeatType": { "name": "Resolution", "slug": "resolution", "status": "active", "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b", "version": 1, "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution." }, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true } ], "arcBeats": [ { "from": 1, "to": 6, "label": "Situation & Context", "description": "The deck starts with an introduction, team bio, and session overview." }, { "from": 7, "to": 14, "label": "Problem & Complication", "description": "The deck presents a health check and diagnosis of the current Splunk environment." }, { "from": 15, "to": 30, "label": "Solution & Approach", "description": "The deck provides a risk-based approach and strategy for success." }, { "from": 31, "to": 52, "label": "Impact & Next Steps", "description": "The deck concludes with key takeaways, a client example, and a call to action." } ], "loops": [ { "from": 12, "to": 14, "label": "Zoom In", "description": "What are the specific issues with the current Splunk environment?" }, { "from": 27, "to": 30, "label": "Mece Breakdown", "description": "How can teams break down their risk score and detection portfolio?" } ] }