{
  "schemaVersion": "deck-intelligence.v1",
  "id": "019dd923-5eff-723e-9be5-94b010d7889b",
  "slug": "d014079089cef381",
  "title": "2023 conf SEC1402A",
  "subtitle": "Splunk",
  "author": "Splunk",
  "pageCount": 22,
  "kind": "consulting-deck",
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "document": {
    "id": "019dd923-5eff-723e-9be5-94b010d7889b",
    "slug": "d014079089cef381",
    "title": "2023 conf SEC1402A",
    "rawTitle": "2023 conf SEC1402A",
    "authorId": "Splunk",
    "authorName": "Splunk",
    "authorDisplay": "Splunk",
    "kind": {
      "slug": "consulting-deck",
      "label": "Consulting deck"
    },
    "sourceType": {
      "slug": "strategy_consulting",
      "label": "Strategy consulting"
    },
    "fileName": "2023-conf-SEC1402A.pdf",
    "sourceUrl": null,
    "sourceDate": "2023-03-16 00:00:00",
    "presentationDate": null,
    "ingestedAt": "2026-04-27 02:45:19+00",
    "status": "ready",
    "pageCount": 22,
    "orientation": "landscape",
    "aspectRatio": 1.778,
    "targetCompany": null,
    "targetTicker": null,
    "metadata": {
      "local_root": "/tmp/legacy-images/d014079089cef381",
      "origin_corpus": "consulting"
    }
  },
  "coverage": {
    "pageCount": 22,
    "pagesIndexed": 22,
    "pagesWithImages": 22,
    "pagesWithMetadata": 22,
    "imageCoveragePct": 100,
    "metadataCoveragePct": 100,
    "componentCount": 119,
    "chartCount": 0,
    "metricSlides": 0,
    "toolMatches": 12,
    "documentToolMatches": 0,
    "frameworkMatches": 2,
    "arcMatches": 1,
    "beatMatches": 4,
    "loopMatches": 1,
    "patternMatches": 0,
    "storymakersMatch": false,
    "scoreAvailable": true,
    "reviewAvailable": true,
    "activistThesisAvailable": false,
    "pitchdeckMetadataAvailable": false,
    "pitchdeckProfileAvailable": false
  },
  "blocks": [],
  "matches": {
    "arcs": [
      {
        "arc": {
          "name": "The Consultant's Gambit",
          "slug": "consultants-gambit",
          "status": "active",
          "bestFor": "Business cases, project proposals, strategic recommendations",
          "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
          "version": 1,
          "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
          "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
          "description": null,
          "familyLabel": null,
          "categoryName": "Strategy & Business",
          "categorySlug": "strategy-business"
        },
        "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
        "evidence": "The document follows a logical structure of introducing a problem, providing context, and presenting a solution.",
        "isPrimary": true,
        "confidence": 0.8,
        "extraction": {
          "at": "2026-07-16 21:27:40.332648+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": "doc-narrative-v1"
        }
      }
    ],
    "beats": [
      {
        "to": 5,
        "arc": {
          "name": "The Consultant's Gambit",
          "slug": "consultants-gambit",
          "status": "active",
          "bestFor": "Business cases, project proposals, strategic recommendations",
          "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
          "version": 1,
          "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
          "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
          "description": null,
          "familyLabel": null,
          "categoryName": "Strategy & Business",
          "categorySlug": "strategy-business"
        },
        "from": 1,
        "name": "Situation & Context",
        "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
        "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
        "beatType": {
          "name": "Situation & Context",
          "slug": "consultants-gambit-situation-context",
          "status": "active",
          "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
          "version": 1,
          "description": null
        },
        "evidence": "The document provides an introduction to the topic and sets the agenda.",
        "position": 0,
        "isPrimaryArc": true,
        "parentBeatType": {
          "name": "Setup",
          "slug": "setup",
          "status": "active",
          "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
          "version": 1,
          "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
        },
        "alignedBlockIds": null,
        "matchConfidence": 0.8
      },
      {
        "to": 8,
        "arc": {
          "name": "The Consultant's Gambit",
          "slug": "consultants-gambit",
          "status": "active",
          "bestFor": "Business cases, project proposals, strategic recommendations",
          "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
          "version": 1,
          "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
          "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
          "description": null,
          "familyLabel": null,
          "categoryName": "Strategy & Business",
          "categorySlug": "strategy-business"
        },
        "from": 6,
        "name": "Problem & Complication",
        "beatId": "f012b7af-449e-4325-b653-776f4b56c119",
        "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
        "beatType": {
          "name": "Problem & Complication",
          "slug": "consultants-gambit-problem-complication",
          "status": "active",
          "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4",
          "version": 1,
          "description": null
        },
        "evidence": "The document explains the need for more effective analytics and risk management.",
        "position": 1,
        "isPrimaryArc": true,
        "parentBeatType": {
          "name": "Complication",
          "slug": "complication",
          "status": "active",
          "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579",
          "version": 1,
          "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs."
        },
        "alignedBlockIds": null,
        "matchConfidence": 0.8
      },
      {
        "to": 13,
        "arc": {
          "name": "The Consultant's Gambit",
          "slug": "consultants-gambit",
          "status": "active",
          "bestFor": "Business cases, project proposals, strategic recommendations",
          "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
          "version": 1,
          "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
          "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
          "description": null,
          "familyLabel": null,
          "categoryName": "Strategy & Business",
          "categorySlug": "strategy-business"
        },
        "from": 9,
        "name": "Evidence & Proof",
        "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
        "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
        "beatType": {
          "name": "Evidence & Proof",
          "slug": "consultants-gambit-evidence-proof",
          "status": "active",
          "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
          "version": 1,
          "description": null
        },
        "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
        "position": 2,
        "isPrimaryArc": true,
        "parentBeatType": {
          "name": "Evidence",
          "slug": "evidence",
          "status": "active",
          "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
          "version": 1,
          "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
        },
        "alignedBlockIds": null,
        "matchConfidence": 0.8
      },
      {
        "to": 19,
        "arc": {
          "name": "The Consultant's Gambit",
          "slug": "consultants-gambit",
          "status": "active",
          "bestFor": "Business cases, project proposals, strategic recommendations",
          "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
          "version": 1,
          "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
          "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
          "description": null,
          "familyLabel": null,
          "categoryName": "Strategy & Business",
          "categorySlug": "strategy-business"
        },
        "from": 14,
        "name": "Impact & Next Steps",
        "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
        "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
        "beatType": {
          "name": "Impact & Next Steps",
          "slug": "consultants-gambit-impact-next-steps",
          "status": "active",
          "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
          "version": 1,
          "description": null
        },
        "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
        "position": 3,
        "isPrimaryArc": true,
        "parentBeatType": {
          "name": "Resolution",
          "slug": "resolution",
          "status": "active",
          "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
          "version": 1,
          "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
        },
        "alignedBlockIds": null,
        "matchConfidence": 0.8
      }
    ],
    "loops": [
      {
        "to": 13,
        "from": 6,
        "loop": {
          "name": "01_logic_chain",
          "slug": "01-logic-chain",
          "status": "active",
          "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
          "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
          "version": 1,
          "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
          "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
          "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
          "familyLabel": null,
          "categoryName": "Logical Reasoning",
          "categorySlug": "logical-reasoning"
        },
        "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
        "evidence": "The document presents a logical chain of ideas and benefits.",
        "position": 0,
        "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 21:27:40.487969+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": "doc-narrative-v1"
        }
      }
    ],
    "tools": [
      {
        "tool": {
          "name": "Slide recipe: Cover",
          "slug": "cover-slide",
          "status": "active",
          "bestFor": null,
          "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3",
          "version": 1,
          "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65",
          "description": "The first ten seconds. Build it deliberately.",
          "familyLabel": "slide-recipe",
          "categoryName": "Slide",
          "categorySlug": "slide"
        },
        "agent": "designer",
        "layer": "slide",
        "agents": [
          "designer"
        ],
        "matchId": "19eb1e55-487e-44c4-96b3-2003fbcac927",
        "evidence": "Analytic Stories and RBA",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.9,
        "extraction": {
          "at": "2026-07-16 22:14:06.120816+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 2,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": null,
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "Process flow",
          "slug": "process-flow",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4dca-76bc-8135-401836a1c4c0",
          "version": 1,
          "bodyDocId": null,
          "description": "Workflow, steps, sequential diagram.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "99adf656-d2a2-4dd2-81e4-a21bd62db4db",
        "evidence": "Search -> Risk Rules (RR) -> Risk Index -> Risk Notable (RN) -> Incident Review",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:06.307377+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 6,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "2x2 matrix",
          "slug": "matrix-2x2",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8",
          "version": 1,
          "bodyDocId": null,
          "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "5494c9f8-a6d0-4402-923b-48cca68fafd1",
        "evidence": "Traditional RBA vs RBA and AS",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.5,
        "extraction": {
          "at": "2026-07-16 22:14:06.4182+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 7,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "Comparison frame",
          "slug": "comparison-frame",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-484b-7399-a4fc-d14644b99f93",
          "version": 1,
          "bodyDocId": null,
          "description": "Two or more states/subjects placed side by side to expose a gap.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "2fe32dff-79f3-4b9c-9682-c42a28bd9ded",
        "evidence": "How are these any different?",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:06.380752+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 7,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "cab32c8b-8437-4a4a-9c67-f9963b379faf",
        "evidence": "Based off of 12 categories:",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:06.531848+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 9,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "cf77a4c6-72aa-4452-8f42-d801c35c56e7",
        "evidence": "list/bullet: Recommended Data Sources: Sysmon, Microsoft Windows, Carbon Black Response, CrowdStrike Falcon, Symantec Endpoint Protection",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.436973+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 11,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "Legend / context",
          "slug": "legend-context",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4e9e-7082-8f2e-c1e169365858",
          "version": 1,
          "bodyDocId": null,
          "description": "Footnote, definition, source attribution.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "a6b6bbf1-0f47-41cd-80eb-d9a970c5ba42",
        "evidence": "legend: Name of AS, Category, All CS related to AS, Data Sources Used, Sourcetypes, Lookups Used, Data Models Used",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.506178+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 12,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "Process flow",
          "slug": "process-flow",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4dca-76bc-8135-401836a1c4c0",
          "version": 1,
          "bodyDocId": null,
          "description": "Workflow, steps, sequential diagram.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "1418d7d1-cd43-464a-a4d0-79c3f7f056f2",
        "evidence": "diagram/process: Choose Correlation Searches -> Create ASC Rules -> Create AS Notable",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.572935+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 13,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "f8475ae0-6540-45f2-8724-9a7deba71115",
        "evidence": "list/bullet: Correlation Search that is used within ES to contribute to an analytic story",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.639886+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 14,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "b6446ed0-7429-4552-8fd0-db28292d0b47",
        "evidence": "list/numbered: 1. Will be based off of the risk index",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.707032+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 15,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "3d89e70a-9444-4451-9cea-5e68f59c694d",
        "evidence": "list/bullet: How AS and RBA can take you to the next level",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.874122+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 19,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      },
      {
        "tool": {
          "name": "List presentation",
          "slug": "list-presentation",
          "status": "active",
          "bestFor": null,
          "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
          "version": 1,
          "bodyDocId": null,
          "description": "Bulleted, numbered, or checklist enumerations.",
          "familyLabel": null,
          "categoryName": null,
          "categorySlug": null
        },
        "agent": null,
        "layer": "slide",
        "agents": null,
        "matchId": "f5913e6c-0592-4346-bc0d-8fab6cc1f513",
        "evidence": "list/bullet: Splunk Lantern Article: Implementing risk-based alerting",
        "pageRefs": null,
        "priority": null,
        "whenToUse": null,
        "confidence": 0.7,
        "extraction": {
          "at": "2026-07-16 22:14:18.974511+00",
          "model": "or:meta-llama/llama-4-scout",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 21,
        "whyItWorks": null,
        "antipattern": null,
        "cardinality": "common",
        "narrativePurpose": null
      }
    ],
    "frameworks": [
      {
        "matchId": "3daed76a-1c00-4637-bac9-246b53defc75",
        "evidence": "The slide uses callout boxes to label parts of a screenshot.",
        "framework": null,
        "confidence": 0.9,
        "extraction": {
          "at": "2026-05-02 17:04:09.198+00",
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 12,
        "frameworkName": "annotation"
      },
      {
        "matchId": "bfdbbc2d-a5ea-4f30-b1a8-da83c1794177",
        "evidence": "Linear flow of three steps",
        "framework": null,
        "confidence": 0.8,
        "extraction": {
          "at": "2026-05-02 17:04:13.288+00",
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "seconds": null,
          "promptVersion": null
        },
        "pageNumber": 13,
        "frameworkName": "process"
      }
    ],
    "patterns": []
  },
  "storymakers": null,
  "score": {
    "backend": "codex",
    "scoredAt": "2026-05-02 14:20:30.537+00",
    "subScores": {
      "scqa_arc": 51,
      "action_titles": 31,
      "mece_structure": 58,
      "closing_strength": 41,
      "evidence_quality": 63,
      "clarity_of_thesis": 48,
      "production_quality": 62,
      "visual_storytelling": 70
    },
    "totalScore": 53,
    "coveragePct": 100,
    "explanations": {
      "scqa_arc": "There is a partial Situation and Complication in slides 5-7 and an Answer in slides 11-18, but the deck reads as a walkthrough rather than a deliberately staged SCQA argument.",
      "action_titles": "Most titles are topic labels or questions rather than conclusions, for example slide 6, \"What is RBA?\"",
      "mece_structure": "The deck mostly separates overview, discovery, example, implementation, and impact, but slides 5/19 and 8/9 repeat learning-objective and analytic-story setup while the RBA-to-ASC logic has gaps.",
      "closing_strength": "The close moves to learning-objective recap, Q&A, appendix resources, and Thank You on slides 19-22, but it does not synthesize a recommendation or explicit next action.",
      "evidence_quality": "Evidence is strongest where screenshots, tables, code, and metrics appear on slides 11-18, but benefit claims such as slide 7 and slide 18 are not visibly sourced in the inventory.",
      "clarity_of_thesis": "Slides 2 and 5 identify the topic and objectives, but they do not state a declarative thesis about why Analytic Stories plus RBA matter; the impact logic only becomes clear around slide 18.",
      "production_quality": "Branding and sparse layouts look consistent, but low action-title density, repeated setup slides, and mixed footnote/source discipline keep production quality moderate.",
      "visual_storytelling": "The deck generally chooses useful technical visuals, with process diagrams on slides 6 and 13, annotated screenshots on slides 12 and 17, and big-number impact on slide 18."
    },
    "slidesAnalyzed": 22
  },
  "review": {
    "backend": null,
    "verdict": "A competent technical conference walkthrough that teaches the mechanics of RBA + Analytic Stories but, judged as a Storymakers exemplar, buries its thesis, leans on topic titles, and lacks a clear arc or call to action.",
    "reviewedAt": "2026-05-01 21:47:10.472+00",
    "slidesSeen": 22,
    "suggestions": [
      "Move the slide 18 metrics (or a one-line version) to slide 2 or 3 as an executive answer-first opener, then prove it across the deck",
      "Rewrite topic titles as action titles: 'What is RBA?' → 'RBA scores risk across events so analysts triage fewer, higher-fidelity alerts'; 'Why Does this Matter?' → 'RBA + AS lifted true-positive rate and cut false positives by [X%]'",
      "Collapse slides 8 and 9 (both 'Intro to Analytic Stories') into a single MECE definition, and remove the duplicate Learning Objectives at slide 19",
      "Add a recommendation/next-steps slide between 18 and Q&A — what the audience should do Monday morning"
    ],
    "closingScore": 40,
    "openingScore": 45,
    "topStrengths": [
      "Slide 18 quantifies impact with four concrete metrics — the strongest editorial moment in the deck",
      "Slides 11-13 walk through a concrete worked example (Remcos malware) that grounds the abstract framework"
    ],
    "topWeaknesses": [
      "Thesis is buried — the answer (combining RBA + Analytic Stories drives measurable SOC gains) does not appear until slide 18 of 22",
      "Titles are interrogative or topical ('What is RBA?', 'How It All Works') rather than declarative insights",
      "Closing sequence (19-22) dilutes the payoff with a redundant objectives slide, Q&A, appendix, and thank-you — no explicit next steps or recommendation"
    ],
    "narrativeScore": 55,
    "pillarCritique": "Section structure is implicit topic-dump (RBA → Analytic Stories → ASC → Demo → Impact) rather than MECE pillars; the duplicate 'Intro to Analytic Stories' (8, 9) and the reappearance of 'Learning Objectives' at slide 19 signal a missing pillar spine.",
    "closingCritique": "Slide 18 delivers the impact metrics but is followed by a redundant Learning Objectives recap (19), a Q&A (20), an appendix (21), and a generic Thank You (22) — there is no explicit recommendation, call to action, or memorable close.",
    "openingCritique": "Slides 1-5 spend four pages on disclaimer, cover, bio, and two agenda/objectives slides before any thesis appears; the audience does not learn the stakes (alert fatigue, false positives) until slide 7, and the answer is never stated up front.",
    "extractionSeconds": 43.913,
    "narrativeCritique": "The deck follows a tutorial sequence (define → demonstrate → quantify) rather than an SCQA arc; the situation/complication is implied rather than stated, and the analytical 'why this matters' payoff lands at slide 18 instead of seeding tension upfront.",
    "titleQualityScore": 30,
    "titleQualityCritique": "Almost every title is a topic label or question, not an action insight: 'What is RBA?' (6), 'Why RBA and AS?' (7), 'Let's Break It Down' (12), 'How It All Works' (13), 'Why Does this Matter?' (18). None state a takeaway like 'RBA + Analytic Stories cut false positives by X%.'"
  },
  "activistThesis": null,
  "pitchdeck": {
    "metadata": null,
    "profile": null
  },
  "slides": [
    {
      "page": 1,
      "type": "setup",
      "function": "other",
      "imagePath": "https://imgproxy.kitesheet.com/63ImJIaPfUbhHCa0VWQDwQ2L6WQYDGeufia2Dc5cBe0/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9kMDE0MDc5MDg5Y2VmMzgxL3AwMDEuanBn",
      "rawType": "appendix_disclosure",
      "block": null,
      "metadata": {
        "slideType": "appendix_disclosure",
        "slideTypeCanon": {
          "name": "Appendix disclosure",
          "slug": "appendix_disclosure",
          "status": "active",
          "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616",
          "version": 1,
          "description": null
        },
        "function": "other",
        "functionCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 29,
        "componentCount": 4,
        "textChars": 465,
        "nDataPoints": 0,
        "notes": null,
        "elementsJson": [
          "headline_text",
          "paragraph",
          "photo",
          "other"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:07.942+00",
          "seconds": 2.414,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/1",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-1",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.75,
            "w": 0.58,
            "x": 0.37,
            "y": 0.12
          },
          "kind": "disclaimer",
          "text": "This presentation may contain forward-looking statements regarding future events, plans or the expected financial performance of our company... [full text omitted for brevity]",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Disclaimer",
              "slug": "disclaimer",
              "status": "active",
              "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc",
              "version": 1,
              "description": "Legal/cautionary text that occupies most of the body of its slide."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.942+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "064d2664-3c12-4ad8-84a5-fe5a9a460380",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.58,
            "x": 0.37,
            "y": 0.86
          },
          "kind": "disclaimer",
          "text": "Splunk, Splunk> and Turn Data Into Doing are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names or trademarks belong to their respective owners. © 2023 Splunk Inc. All rights reserved.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Disclaimer",
              "slug": "disclaimer",
              "status": "active",
              "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc",
              "version": 1,
              "description": "Legal/cautionary text that occupies most of the body of its slide."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.942+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d1169577-f177-416d-b92c-1e78582ad2d5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.55,
            "w": 0.28,
            "x": 0.05,
            "y": 0.4
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Photo",
              "slug": "photo",
              "status": "active",
              "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "photo",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.942+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "7d2fa56a-6b53-4e84-a074-53e2376ae0e8",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.15,
            "w": 0.28,
            "x": 0.05,
            "y": 0.12
          },
          "kind": "title",
          "text": "Forward-Looking Statements",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.942+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "39dfbc7c-56c9-435d-9b2f-c78ba55345e9",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 5,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 1,
          "name": "Situation & Context",
          "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Situation & Context",
            "slug": "consultants-gambit-situation-context",
            "status": "active",
            "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides an introduction to the topic and sets the agenda.",
          "position": 0,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Setup",
            "slug": "setup",
            "status": "active",
            "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
            "version": 1,
            "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "thumbSrc": "https://imgproxy.kitesheet.com/NW02C3TixM5c7LvGDLw4TGK8IAOyzWUrL0Z40CEIxXU/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9kMDE0MDc5MDg5Y2VmMzgxL3AwMDEuanBn",
      "imagePathAlt": "https://imgproxy.kitesheet.com/lxptYPyz0Eqb3KRefiipB8AEidzVpddlaeeGa2O9Up8/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9kMDE0MDc5MDg5Y2VmMzgxL3AwMDEucG5n",
      "thumbSrcAlt": "https://imgproxy.kitesheet.com/O10DWELSqphYldbzBPvcpIIhQSoEGVYJfD3teSnhsf8/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy9kMDE0MDc5MDg5Y2VmMzgxL3AwMDEucG5n"
    },
    {
      "page": 2,
      "type": "setup",
      "title": "The slide features a stylized, playful graphic with a person, a dog, and a stack of donuts, consistent with Splunk .conf branding.",
      "function": "front_matter",
      "rawType": "cover",
      "block": null,
      "metadata": {
        "slideType": "cover",
        "slideTypeCanon": {
          "name": "Cover",
          "slug": "cover",
          "status": "active",
          "canonId": "019de52d-05f2-729d-9f93-e0504f0a2410",
          "version": 1,
          "description": null
        },
        "function": "front_matter",
        "functionCanon": {
          "name": "Front matter",
          "slug": "front_matter",
          "status": "active",
          "canonId": "019de52d-133d-73f0-9e26-201eda96b098",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 20,
        "componentCount": 5,
        "textChars": 121,
        "nDataPoints": 0,
        "notes": "The slide features a stylized, playful graphic with a person, a dog, and a stack of donuts, consistent with Splunk .conf branding.",
        "elementsJson": [
          "headline_text",
          "subtitle_text",
          "photo",
          "logo_grid"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:08.672+00",
          "seconds": 3.091,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/2",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-2",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.75,
            "w": 0.45,
            "x": 0.5,
            "y": 0.1
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Illustration",
              "slug": "illustration",
              "status": "active",
              "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "illustration",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.672+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f2ca02f5-573d-4c14-b85c-31c519a27b9b",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.25,
            "x": 0.7,
            "y": 0.85
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Logo",
              "slug": "logo",
              "status": "active",
              "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "logo",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.672+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "e1d0db8e-519d-4f17-996b-cc0cda4856ba",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.3,
            "x": 0.05,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "Ryan Moss\nPrincipal Security Engineer | Verizon",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.672+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0ccc5264-b093-49bb-8f94-7957ce230005",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.15,
            "w": 0.4,
            "x": 0.05,
            "y": 0.25
          },
          "kind": "title",
          "text": "Analytic Stories and RBA",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.672+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "4d2f5d76-3c69-486b-bc42-6113e9c3c237",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.35,
            "x": 0.05,
            "y": 0.45
          },
          "kind": "title",
          "text": "Converting Those Notables From NM to OMG! SEC1402A",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.672+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "99edcde8-61c7-4036-8100-26b3ef1f4bd4",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "Slide recipe: Cover",
            "slug": "cover-slide",
            "status": "active",
            "bestFor": null,
            "canonId": "019df269-2a08-767d-9128-e7431e6fe8a3",
            "version": 1,
            "bodyDocId": "019df269-29e5-7738-b5fa-6892e5dc8e65",
            "description": "The first ten seconds. Build it deliberately.",
            "familyLabel": "slide-recipe",
            "categoryName": "Slide",
            "categorySlug": "slide"
          },
          "agent": "designer",
          "layer": "slide",
          "agents": [
            "designer"
          ],
          "matchId": "19eb1e55-487e-44c4-96b3-2003fbcac927",
          "evidence": "Analytic Stories and RBA",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.9,
          "extraction": {
            "at": "2026-07-16 22:14:06.120816+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 2,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": null,
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 5,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 1,
          "name": "Situation & Context",
          "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Situation & Context",
            "slug": "consultants-gambit-situation-context",
            "status": "active",
            "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides an introduction to the topic and sets the agenda.",
          "position": 0,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Setup",
            "slug": "setup",
            "status": "active",
            "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
            "version": 1,
            "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 3,
      "type": "setup",
      "title": "Includes a stylized photo of the speaker and a toaster graphic.",
      "function": "other",
      "rawType": "team_bio",
      "block": null,
      "metadata": {
        "slideType": "team_bio",
        "slideTypeCanon": {
          "name": "Team bio",
          "slug": "team_bio",
          "status": "active",
          "canonId": "019de52d-0a7d-7394-ae5b-037478e71f1e",
          "version": 1,
          "description": null
        },
        "function": "other",
        "functionCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 17,
        "componentCount": 5,
        "textChars": 46,
        "nDataPoints": 0,
        "notes": "Includes a stylized photo of the speaker and a toaster graphic.",
        "elementsJson": [
          "headshot",
          "photo"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:08.011+00",
          "seconds": 2.228,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/3",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-3",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.34,
            "w": 0.34,
            "x": 0.096,
            "y": 0.177
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Headshot",
              "slug": "headshot",
              "status": "active",
              "canonId": "019de52c-fd5f-765c-9282-38b54f61bbbf",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headshot",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.011+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "5dbd04d2-b1cc-4560-bb93-309501e53a50",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.083,
            "w": 0.11,
            "x": 0.384,
            "y": 0.633
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Illustration",
              "slug": "illustration",
              "status": "active",
              "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "illustration",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.011+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "84e70dae-3548-4c12-965e-bc0603fc5a20",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.035,
            "w": 0.126,
            "x": 0.854,
            "y": 0.931
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Logo",
              "slug": "logo",
              "status": "active",
              "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "logo",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.011+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "7ca40ab0-57bb-4db2-a24e-2b78aefee249",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.032,
            "w": 0.365,
            "x": 0.491,
            "y": 0.528
          },
          "kind": "paragraph",
          "text": "Principal Security Engineer | Verizon",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.011+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "7a5f7161-756a-43ab-9663-cb0f04d9234d",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.048,
            "w": 0.187,
            "x": 0.491,
            "y": 0.443
          },
          "kind": "title",
          "text": "Ryan Moss",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.011+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "00bbdfdf-16c9-48da-be07-d45193b87600",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 5,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 1,
          "name": "Situation & Context",
          "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Situation & Context",
            "slug": "consultants-gambit-situation-context",
            "status": "active",
            "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides an introduction to the topic and sets the agenda.",
          "position": 0,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Setup",
            "slug": "setup",
            "status": "active",
            "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
            "version": 1,
            "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 4,
      "type": "setup",
      "function": "front_matter",
      "rawType": "agenda",
      "block": null,
      "metadata": {
        "slideType": "agenda",
        "slideTypeCanon": {
          "name": "Agenda",
          "slug": "agenda",
          "status": "active",
          "canonId": "019de52d-061b-7470-b138-3ffa5e612cce",
          "version": 1,
          "description": null
        },
        "function": "front_matter",
        "functionCanon": {
          "name": "Front matter",
          "slug": "front_matter",
          "status": "active",
          "canonId": "019de52d-133d-73f0-9e26-201eda96b098",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 6,
        "componentCount": 2,
        "textChars": 124,
        "nDataPoints": 0,
        "notes": null,
        "elementsJson": [
          "numbered_list",
          "photo"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:07.711+00",
          "seconds": 1.904,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/4",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-4",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.3,
            "w": 0.4,
            "x": 0.42,
            "y": 0.175
          },
          "kind": "list",
          "text": "1. Brief Overview of RBA\n2. Intro to Analytic Stories (AS)\n3. How to Create Risk Rules from AS\n4. Key Takeaways\n5. Q&A",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Numbered list",
              "slug": "numbered",
              "status": "active",
              "canonId": "019de52c-fcc0-7718-a284-a4250c805df2",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "numbered",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.711+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "fe55b4de-3d6f-46b2-a695-0d600eaa8ae2",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.2,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Agenda",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:07.711+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "3703a617-b9e5-4c79-a46a-64879ae4fce8",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 5,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 1,
          "name": "Situation & Context",
          "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Situation & Context",
            "slug": "consultants-gambit-situation-context",
            "status": "active",
            "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides an introduction to the topic and sets the agenda.",
          "position": 0,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Setup",
            "slug": "setup",
            "status": "active",
            "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
            "version": 1,
            "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 5,
      "type": "setup",
      "title": "The slide uses a three-column layout with icons to represent the learning goals.",
      "function": "summarize",
      "rawType": "agenda",
      "block": null,
      "metadata": {
        "slideType": "agenda",
        "slideTypeCanon": {
          "name": "Agenda",
          "slug": "agenda",
          "status": "active",
          "canonId": "019de52d-061b-7470-b138-3ffa5e612cce",
          "version": 1,
          "description": null
        },
        "function": "summarize",
        "functionCanon": {
          "name": "Summarize",
          "slug": "summarize",
          "status": "active",
          "canonId": "019de52d-1541-704f-b86f-bf7b75056373",
          "version": 1,
          "description": null
        },
        "density": "dense",
        "densityScore": 66,
        "componentCount": 11,
        "textChars": 423,
        "nDataPoints": 0,
        "notes": "The slide uses a three-column layout with icons to represent the learning goals.",
        "elementsJson": [
          "headline_text",
          "subtitle_text",
          "icon_grid"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.167+00",
          "seconds": 3.312,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/5",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-5",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.25,
            "w": 0.18,
            "x": 0.11,
            "y": 0.48
          },
          "kind": "image",
          "text": "Question mark icon",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": "iconography",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "44643ef6-90fb-4906-9433-7b3b0bc2e387",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.25,
            "w": 0.18,
            "x": 0.42,
            "y": 0.48
          },
          "kind": "image",
          "text": "Network/environment icon",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": "iconography",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "6a2646f0-00f5-4ad2-bdd0-05b552ed4a0d",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.25,
            "w": 0.18,
            "x": 0.72,
            "y": 0.48
          },
          "kind": "image",
          "text": "Stairs/growth icon",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": "iconography",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "7d9327b6-95f6-49d7-a83a-c0c055db55ff",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.38,
            "y": 0.31
          },
          "kind": "list",
          "text": "How you can utilize AS in your environment",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "11a367de-1468-41dc-beaa-fa62fd7e9367",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.07,
            "y": 0.35
          },
          "kind": "list",
          "text": "What are analytic stories (AS)?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "6000b990-e130-4f09-99ed-5748323fd7bf",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.68,
            "y": 0.31
          },
          "kind": "list",
          "text": "How AS and RBA can take you to the next level",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "c3367bda-b5dd-42a9-8d35-f2642af072a5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.38,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Discuss how you can utilize AS and RBA to reduce alert fatigue",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "2738e290-c11b-4eae-8fd2-e7c9da1a0a8e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.07,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Define what analytic stories are and how they are found",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "840b5c61-317d-4f6b-a4a3-a340e29d1ead",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.68,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Look at how AS can bridge the gap between strictly RBA and 1-1 alerting",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a82aae75-9f88-4866-8896-4e8e46dea977",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.35,
            "x": 0.05,
            "y": 0.22
          },
          "kind": "subtitle",
          "text": "What are you going to get out of this?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "82d821ee-2793-42e7-8f16-c6131385a3ce",
              "version": 1,
              "description": "Header-zone supporting text near the title (= ex body.description with bbox)."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0cff5a14-6e98-40f4-ac55-ea9b73147555",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.35,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Learning Objectives",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.167+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f5b0c28e-8cce-4e70-86ab-b08132eb95d2",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 5,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 1,
          "name": "Situation & Context",
          "beatId": "7bfba9b9-ae3b-4e04-b6f1-5bdb87d0aba5",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Situation & Context",
            "slug": "consultants-gambit-situation-context",
            "status": "active",
            "canonId": "019dd9b8-05ae-741b-992d-65ee83c639b3",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides an introduction to the topic and sets the agenda.",
          "position": 0,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Setup",
            "slug": "setup",
            "status": "active",
            "canonId": "019dd9b8-020e-7505-af9b-d9b9a4679bcc",
            "version": 1,
            "description": "Where the deck grounds the reader before doing anything else. Almost every arc opens here."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 6,
      "type": "appendix",
      "title": "The slide uses a linear process flow to describe the RBA lifecycle.",
      "function": "present_framework",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "present_framework",
        "functionCanon": {
          "name": "Present framework",
          "slug": "present_framework",
          "status": "active",
          "canonId": "019de52d-1403-7667-9100-d2ac6709f750",
          "version": 1,
          "description": null
        },
        "density": "dense",
        "densityScore": 57,
        "componentCount": 8,
        "textChars": 435,
        "nDataPoints": 0,
        "notes": "The slide uses a linear process flow to describe the RBA lifecycle.",
        "elementsJson": [
          "headline_text",
          "process_diagram"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:08.712+00",
          "seconds": 2.813,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/6",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-6",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.2,
            "w": 0.9,
            "x": 0.05,
            "y": 0.45
          },
          "kind": "diagram",
          "text": "Search -> Risk Rules (RR) -> Risk Index -> Risk Notable (RN) -> Incident Review",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Diagram",
              "slug": "diagram",
              "status": "active",
              "canonId": "019de52c-f9f0-734a-81de-15382ff28c65",
              "version": 1,
              "description": "Schematic or relational diagram."
            },
            "tool": null,
            "subkind": {
              "name": "Process flow",
              "slug": "process",
              "status": "active",
              "canonId": "019de52d-039c-718f-ad3a-efe9c4b3c838",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "process",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "5e8f54c7-124d-496e-80e1-bb196e62b7e5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.15,
            "x": 0.8,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "Risk Notables are then populated into Incident Review for analysts to investigate",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "36ab76c1-f8ac-49d5-9cf0-e6891f7033f9",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.15,
            "x": 0.42,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "As badness is found, it is written to the risk index",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "76debe85-2946-42ed-9f1a-9aa322879b32",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.15,
            "x": 0.23,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "Create a new risk rule as a correlation search",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "b13a1d1c-1cf8-4b96-bcfa-60f5581d804e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.15,
            "x": 0.05,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "Run your search within Splunk ES to find what you're looking for",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d513926f-d4eb-4c26-8ab6-c69e43b70f81",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.15,
            "x": 0.61,
            "y": 0.7
          },
          "kind": "paragraph",
          "text": "Create a risk notable looking for \"risky\" behavior based off the the RR",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d6705a49-3fe7-472a-ab1d-8b45b305ac4c",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.25,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "What is RBA?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0bde931d-5a9e-4622-91a6-240509efd52e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.25,
            "x": 0.05,
            "y": 0.21
          },
          "kind": "title",
          "text": "How RBA works within Splunk ES",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.712+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "c672deec-3e18-475d-aef6-b44db6f813c7",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "Process flow",
            "slug": "process-flow",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4dca-76bc-8135-401836a1c4c0",
            "version": 1,
            "bodyDocId": null,
            "description": "Workflow, steps, sequential diagram.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "99adf656-d2a2-4dd2-81e4-a21bd62db4db",
          "evidence": "Search -> Risk Rules (RR) -> Risk Index -> Risk Notable (RN) -> Incident Review",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:06.307377+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 6,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 8,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 6,
          "name": "Problem & Complication",
          "beatId": "f012b7af-449e-4325-b653-776f4b56c119",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Problem & Complication",
            "slug": "consultants-gambit-problem-complication",
            "status": "active",
            "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4",
            "version": 1,
            "description": null
          },
          "evidence": "The document explains the need for more effective analytics and risk management.",
          "position": 1,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Complication",
            "slug": "complication",
            "status": "active",
            "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579",
            "version": 1,
            "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 7,
      "type": "setup",
      "title": "RBA = Risk-Based Alerting; AS = Adaptive Response (implied context).",
      "function": "compare_options",
      "rawType": "comparison_table",
      "block": null,
      "metadata": {
        "slideType": "comparison_table",
        "slideTypeCanon": {
          "name": "Comparison table",
          "slug": "comparison_table",
          "status": "active",
          "canonId": "019de52d-0a06-73f8-8813-fe022fab1de2",
          "version": 1,
          "description": null
        },
        "function": "compare_options",
        "functionCanon": {
          "name": "Compare options",
          "slug": "compare_options",
          "status": "active",
          "canonId": "019de52d-167f-7038-aebc-70a9d2e0e33b",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 41,
        "componentCount": 6,
        "textChars": 418,
        "nDataPoints": 0,
        "notes": "RBA = Risk-Based Alerting; AS = Adaptive Response (implied context).",
        "elementsJson": [
          "headline_text",
          "bullet_list"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:13.413+00",
          "seconds": 7.269,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/7",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-7",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.2,
            "w": 0.4,
            "x": 0.05,
            "y": 0.48
          },
          "kind": "list",
          "text": "Can be difficult to investigate if analysts are not familiar with how RBA works\nTraditionally based off of thresholds\nRequires more curation to provide value",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d7010aa2-6f5d-4a95-9e62-a30e9dfe4f96",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.25,
            "w": 0.4,
            "x": 0.52,
            "y": 0.48
          },
          "kind": "list",
          "text": "Can be more targeted instead of general\nGives the analysts more information to begin their investigation\nCan weed out more non-malicious/false positives as you are correlating more data sources",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "df9017da-d634-4a0f-a9d6-b134b0bc0be7",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.25,
            "x": 0.05,
            "y": 0.34
          },
          "kind": "title",
          "text": "Traditional RBA",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0933b413-a20c-48cc-8261-8218a1fd9ca2",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.2,
            "x": 0.52,
            "y": 0.34
          },
          "kind": "title",
          "text": "RBA and AS",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "172a2335-4dc1-427c-a916-457754e5f224",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.4,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Why RBA and AS?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "76474726-a7c5-4e03-abde-10b054c3ffdd",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.3,
            "x": 0.05,
            "y": 0.22
          },
          "kind": "title",
          "text": "How are these any different?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.413+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a863740a-bcba-416b-9336-f24b5e7f3031",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "2x2 matrix",
            "slug": "matrix-2x2",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-50ab-72d1-8afb-3ab0a38e32a8",
            "version": 1,
            "bodyDocId": null,
            "description": "BCG matrix, importance/urgency, any axes-and-quadrants frame.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "5494c9f8-a6d0-4402-923b-48cca68fafd1",
          "evidence": "Traditional RBA vs RBA and AS",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.5,
          "extraction": {
            "at": "2026-07-16 22:14:06.4182+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 7,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        },
        {
          "tool": {
            "name": "Comparison frame",
            "slug": "comparison-frame",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-484b-7399-a4fc-d14644b99f93",
            "version": 1,
            "bodyDocId": null,
            "description": "Two or more states/subjects placed side by side to expose a gap.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "2fe32dff-79f3-4b9c-9682-c42a28bd9ded",
          "evidence": "How are these any different?",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:06.380752+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 7,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 8,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 6,
          "name": "Problem & Complication",
          "beatId": "f012b7af-449e-4325-b653-776f4b56c119",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Problem & Complication",
            "slug": "consultants-gambit-problem-complication",
            "status": "active",
            "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4",
            "version": 1,
            "description": null
          },
          "evidence": "The document explains the need for more effective analytics and risk management.",
          "position": 1,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Complication",
            "slug": "complication",
            "status": "active",
            "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579",
            "version": 1,
            "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 8,
      "type": "appendix",
      "title": "The slide features a screenshot of a software interface (Use Case Library) inside a laptop mockup.",
      "function": "establish_context",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "establish_context",
        "functionCanon": {
          "name": "Establish context",
          "slug": "establish_context",
          "status": "active",
          "canonId": "019de52d-1314-74e6-9074-d213dc0bdcdf",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 26,
        "componentCount": 4,
        "textChars": 400,
        "nDataPoints": 0,
        "notes": "The slide features a screenshot of a software interface (Use Case Library) inside a laptop mockup.",
        "elementsJson": [
          "screenshot",
          "paragraph"
        ],
        "confidence": 0.9,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.604+00",
          "seconds": 4.412,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/8",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-8",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": null,
          "kind": "callout",
          "text": "Explore the Analytic Stories included with Enterprise Security that provide analysis guidance on how to investigate and take actions on threats that ES detects.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": {
              "name": "Visual emphasis",
              "slug": "visual-emphasis",
              "status": "active",
              "bestFor": null,
              "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c",
              "version": 1,
              "bodyDocId": null,
              "description": "Drawing the eye to one element above the rest of the slide.",
              "familyLabel": null
            },
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-04-27 07:18:44+00",
            "model": "or:google/gemini-3.1-flash-lite-preview",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "019dd952-832b-73b4-83a7-a7f6b382ec09",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.8,
            "w": 0.66,
            "x": 0.32,
            "y": 0.08
          },
          "kind": "image",
          "text": "Use Case Library interface screenshot",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Screenshot",
              "slug": "screenshot",
              "status": "active",
              "canonId": "019de52c-fd87-7509-8391-3d79fb339379",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "screenshot",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.604+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "718a50ee-2e8c-4c4e-8ded-6951862652d0",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.55,
            "x": 0.38,
            "y": 0.12
          },
          "kind": "paragraph",
          "text": "Use Case Library: Explore the Analytic Stories included with Enterprise Security that provide analysis guidance on how to investigate and take actions on threats that ES detects.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.604+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "c1611725-d57a-48e3-a10a-256d93dbd539",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.15,
            "w": 0.23,
            "x": 0.05,
            "y": 0.338
          },
          "kind": "title",
          "text": "Intro to Analytic Stories",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.604+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "ad873146-e4d7-444c-b87f-7d2f3f1414ba",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 8,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 6,
          "name": "Problem & Complication",
          "beatId": "f012b7af-449e-4325-b653-776f4b56c119",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Problem & Complication",
            "slug": "consultants-gambit-problem-complication",
            "status": "active",
            "canonId": "019dd9b8-064a-777f-a374-e9a8c43dedd4",
            "version": 1,
            "description": null
          },
          "evidence": "The document explains the need for more effective analytics and risk management.",
          "position": 1,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Complication",
            "slug": "complication",
            "status": "active",
            "canonId": "019dd9b8-0275-7709-b2d6-4f77c3fc7579",
            "version": 1,
            "description": "The point in the narrative where the audience should feel discomfort. Required for argumentative arcs."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 9,
      "type": "appendix",
      "title": "The slide uses a simple list to define the scope of analytic stories.",
      "function": "establish_context",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "establish_context",
        "functionCanon": {
          "name": "Establish context",
          "slug": "establish_context",
          "status": "active",
          "canonId": "019de52d-1314-74e6-9074-d213dc0bdcdf",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 19,
        "componentCount": 4,
        "textChars": 266,
        "nDataPoints": 0,
        "notes": "The slide uses a simple list to define the scope of analytic stories.",
        "elementsJson": [
          "headline_text",
          "subtitle_text",
          "bullet_list"
        ],
        "confidence": 0.9,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.531+00",
          "seconds": 4.318,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/9",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-9",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.5,
            "w": 0.25,
            "x": 0.05,
            "y": 0.38
          },
          "kind": "list",
          "text": "Abuse\nAccount Compromise\nAdversary Tactics\nBest Practices\nCloud Security\nData Destruction\nLateral Movement\nMalware\nPrivilege Escalation\nRansomware\nUnauthorized Software\nVulnerability",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.531+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0cdd34bd-3634-4e02-9853-716c93f0a94d",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.2,
            "x": 0.05,
            "y": 0.34
          },
          "kind": "paragraph",
          "text": "Based off of 12 categories:",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.531+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "3e9cb899-4713-46fc-8357-0c9c1ec939d6",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.45,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Intro to Analytic Stories",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.531+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "15303520-012c-454f-bf88-7a1a9b7729be",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.3,
            "x": 0.05,
            "y": 0.22
          },
          "kind": "title",
          "text": "What are you even talking about?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.531+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "2d6d9f13-efd7-4783-aaed-435b5ec72219",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "cab32c8b-8437-4a4a-9c67-f9963b379faf",
          "evidence": "Based off of 12 categories:",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:06.531848+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 9,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 13,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 9,
          "name": "Evidence & Proof",
          "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Evidence & Proof",
            "slug": "consultants-gambit-evidence-proof",
            "status": "active",
            "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
          "position": 2,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Evidence",
            "slug": "evidence",
            "status": "active",
            "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
            "version": 1,
            "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 10,
      "type": "appendix",
      "function": "state_next_steps",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "state_next_steps",
        "functionCanon": {
          "name": "State next steps",
          "slug": "state_next_steps",
          "status": "active",
          "canonId": "019de52d-14ca-70ac-b534-971f458cdf29",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 14,
        "componentCount": 3,
        "textChars": 238,
        "nDataPoints": 0,
        "notes": null,
        "elementsJson": [
          "headline_text",
          "bullet_list"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:08.747+00",
          "seconds": 2.313,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/10",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-10",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.15,
            "w": 0.7,
            "x": 0.055,
            "y": 0.41
          },
          "kind": "list",
          "text": "Splunk ES Content Updates (https://splunkbase.splunk.com/app/3449)\nSplunk Security Essentials (https://splunkbase.splunk.com/app/3435)\nSplunk Security Content (https://research.splunk.com/stories/)",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.747+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "e18455aa-0fd6-4f05-9d60-09e182e8ade8",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.2,
            "x": 0.055,
            "y": 0.345
          },
          "kind": "paragraph",
          "text": "A few ways to find them:",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.747+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "0d4074b7-a249-4f58-b63f-5a73a2b69bea",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.35,
            "x": 0.055,
            "y": 0.145
          },
          "kind": "title",
          "text": "How to Find Them?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:08.747+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "e4e3512a-2f7b-4153-b24a-32e2d7185d22",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 13,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 9,
          "name": "Evidence & Proof",
          "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Evidence & Proof",
            "slug": "consultants-gambit-evidence-proof",
            "status": "active",
            "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
          "position": 2,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Evidence",
            "slug": "evidence",
            "status": "active",
            "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
            "version": 1,
            "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 11,
      "type": "analysis",
      "title": "This is a screenshot of a Splunk Security Essentials interface.",
      "function": "present_framework",
      "rawType": "kpi_dashboard",
      "block": null,
      "metadata": {
        "slideType": "kpi_dashboard",
        "slideTypeCanon": {
          "name": "KPI dashboard",
          "slug": "kpi_dashboard",
          "status": "active",
          "canonId": "019de52d-0be5-7295-af4d-b850fe7b7e65",
          "version": 1,
          "description": null
        },
        "function": "present_framework",
        "functionCanon": {
          "name": "Present framework",
          "slug": "present_framework",
          "status": "active",
          "canonId": "019de52d-1403-7667-9100-d2ac6709f750",
          "version": 1,
          "description": null
        },
        "density": "dense",
        "densityScore": 70,
        "componentCount": 8,
        "textChars": 895,
        "nDataPoints": 0,
        "notes": "This is a screenshot of a Splunk Security Essentials interface.",
        "elementsJson": [
          "data_table"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.641+00",
          "seconds": 3.103,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/11",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-11",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": null,
          "kind": "callout",
          "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": {
              "name": "Visual emphasis",
              "slug": "visual-emphasis",
              "status": "active",
              "bestFor": null,
              "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c",
              "version": 1,
              "bodyDocId": null,
              "description": "Drawing the eye to one element above the rest of the slide.",
              "familyLabel": null
            },
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-04-27 07:18:46+00",
            "model": "or:google/gemini-3.1-flash-lite-preview",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "019dd952-832b-73b4-83a8-7767a2d4cf87",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.05,
            "x": 0.67,
            "y": 0.22
          },
          "kind": "list",
          "text": "Data Models: Endpoint",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "13667279-3168-4fac-8d61-4a8a1decb3c5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.1,
            "x": 0.54,
            "y": 0.22
          },
          "kind": "list",
          "text": "Sourcetypes: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "5391d683-ef79-4541-9cb2-946f70e1fab2",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.15,
            "w": 0.1,
            "x": 0.42,
            "y": 0.22
          },
          "kind": "list",
          "text": "Recommended Data Sources: Sysmon, Microsoft Windows, Carbon Black Response, CrowdStrike Falcon, Symantec Endpoint Protection",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "8ba75c08-d1e8-45df-b8bf-ea73573755c7",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.65,
            "w": 0.28,
            "x": 0.11,
            "y": 0.22
          },
          "kind": "list",
          "text": "Correlation Searches list including Windows Defender exclusions, process spawning, and registry modifications.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "ee89b4d7-32af-4ebb-9522-6979b8eae563",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.05,
            "x": 0.79,
            "y": 0.22
          },
          "kind": "list",
          "text": "Lookups: No items found.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f89eb90e-2154-448a-a038-4292490b05a5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.45,
            "x": 0.32,
            "y": 0.07
          },
          "kind": "paragraph",
          "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d5408ebb-149a-42a2-9500-6475e5ea16c1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.1,
            "x": 0.15,
            "y": 0.07
          },
          "kind": "title",
          "text": "Remcos Malware",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.641+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "22103eb7-b39a-4dca-807c-21784bef9042",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "cf77a4c6-72aa-4452-8f42-d801c35c56e7",
          "evidence": "list/bullet: Recommended Data Sources: Sysmon, Microsoft Windows, Carbon Black Response, CrowdStrike Falcon, Symantec Endpoint Protection",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.436973+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 11,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 13,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 9,
          "name": "Evidence & Proof",
          "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Evidence & Proof",
            "slug": "consultants-gambit-evidence-proof",
            "status": "active",
            "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
          "position": 2,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Evidence",
            "slug": "evidence",
            "status": "active",
            "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
            "version": 1,
            "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 12,
      "type": "setup",
      "title": "The slide uses callout boxes to label specific UI elements of a Splunk dashboard, effectively acting as a legend or guide for the software interface.",
      "function": "present_framework",
      "rawType": "diagnosis",
      "block": null,
      "metadata": {
        "slideType": "diagnosis",
        "slideTypeCanon": {
          "name": "Diagnosis",
          "slug": "diagnosis",
          "status": "active",
          "canonId": "019de52d-0cd7-7212-898f-0464041ff8d8",
          "version": 1,
          "description": null
        },
        "function": "present_framework",
        "functionCanon": {
          "name": "Present framework",
          "slug": "present_framework",
          "status": "active",
          "canonId": "019de52d-1403-7667-9100-d2ac6709f750",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 27,
        "componentCount": 4,
        "textChars": 430,
        "nDataPoints": 0,
        "notes": "The slide uses callout boxes to label specific UI elements of a Splunk dashboard, effectively acting as a legend or guide for the software interface.",
        "elementsJson": [
          "headline_text",
          "process_diagram",
          "bullet_list"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.198+00",
          "seconds": 2.585,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/12",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-12",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": null,
          "kind": "callout",
          "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": {
              "name": "Visual emphasis",
              "slug": "visual-emphasis",
              "status": "active",
              "bestFor": null,
              "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c",
              "version": 1,
              "bodyDocId": null,
              "description": "Drawing the eye to one element above the rest of the slide.",
              "familyLabel": null
            },
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-04-27 07:18:46+00",
            "model": "or:google/gemini-3.1-flash-lite-preview",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "019dd952-832b-73b4-83a8-9c87a4300bdc",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.72,
            "w": 0.84,
            "x": 0.08,
            "y": 0.235
          },
          "kind": "image",
          "text": "Splunk Security Essentials interface",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Screenshot",
              "slug": "screenshot",
              "status": "active",
              "canonId": "019de52c-fd87-7509-8391-3d79fb339379",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "screenshot",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.198+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "eb04f887-5cba-417e-8e77-25a4c2764fe0",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.5,
            "w": 0.75,
            "x": 0.12,
            "y": 0.25
          },
          "kind": "legend",
          "text": "Name of AS, Category, All CS related to AS, Data Sources Used, Sourcetypes, Lookups Used, Data Models Used",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Legend",
              "slug": "legend",
              "status": "active",
              "canonId": "31361933-3d22-4c70-bbad-0801e9fffc0c",
              "version": 1,
              "description": "Color/symbol decoder placed adjacent to a chart or diagram."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.198+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "9e814d27-02f9-4f0a-a5b7-623bf8946229",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.05,
            "w": 0.25,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Let's Break It Down",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.198+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a31aeb4b-b4e6-4c05-b1a5-1db110088481",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "Legend / context",
            "slug": "legend-context",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4e9e-7082-8f2e-c1e169365858",
            "version": 1,
            "bodyDocId": null,
            "description": "Footnote, definition, source attribution.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "a6b6bbf1-0f47-41cd-80eb-d9a970c5ba42",
          "evidence": "legend: Name of AS, Category, All CS related to AS, Data Sources Used, Sourcetypes, Lookups Used, Data Models Used",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.506178+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 12,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [
        {
          "matchId": "3daed76a-1c00-4637-bac9-246b53defc75",
          "evidence": "The slide uses callout boxes to label parts of a screenshot.",
          "framework": null,
          "confidence": 0.9,
          "extraction": {
            "at": "2026-05-02 17:04:09.198+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 12,
          "frameworkName": "annotation"
        }
      ],
      "arcBeats": [
        {
          "to": 13,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 9,
          "name": "Evidence & Proof",
          "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Evidence & Proof",
            "slug": "consultants-gambit-evidence-proof",
            "status": "active",
            "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
          "position": 2,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Evidence",
            "slug": "evidence",
            "status": "active",
            "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
            "version": 1,
            "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 13,
      "type": "resolution",
      "title": "The slide uses a simple linear process flow diagram.",
      "function": "plan_implementation",
      "rawType": "implementation_plan",
      "block": null,
      "metadata": {
        "slideType": "implementation_plan",
        "slideTypeCanon": {
          "name": "Implementation plan",
          "slug": "implementation_plan",
          "status": "active",
          "canonId": "019de52d-0d75-700b-ae9f-f6069ba6e37a",
          "version": 1,
          "description": null
        },
        "function": "plan_implementation",
        "functionCanon": {
          "name": "Plan implementation",
          "slug": "plan_implementation",
          "status": "active",
          "canonId": "019de52d-14a2-77ea-b210-d6a95eed4823",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 34,
        "componentCount": 6,
        "textChars": 277,
        "nDataPoints": 0,
        "notes": "The slide uses a simple linear process flow diagram.",
        "elementsJson": [
          "headline_text",
          "process_diagram"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:13.288+00",
          "seconds": 6.186,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/13",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-13",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.3,
            "w": 0.8,
            "x": 0.1,
            "y": 0.045
          },
          "kind": "diagram",
          "text": "Choose Correlation Searches -> Create ASC Rules -> Create AS Notable",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Diagram",
              "slug": "diagram",
              "status": "active",
              "canonId": "019de52c-f9f0-734a-81de-15382ff28c65",
              "version": 1,
              "description": "Schematic or relational diagram."
            },
            "tool": null,
            "subkind": {
              "name": "Process flow",
              "slug": "process",
              "status": "active",
              "canonId": "019de52d-039c-718f-ad3a-efe9c4b3c838",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "process",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "780d1373-c7bd-45be-acf5-26d6fad779f1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.2,
            "x": 0.08,
            "y": 0.078
          },
          "kind": "paragraph",
          "text": "Decide which correlation searches you want to run for your AS",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "153de6c5-7bd7-46b6-8d10-6d4ebf0a8997",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.2,
            "x": 0.38,
            "y": 0.078
          },
          "kind": "paragraph",
          "text": "Convert those searches to a risk rule",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "2fe55b6b-388d-4bee-82f0-455414af6b72",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.1,
            "w": 0.2,
            "x": 0.68,
            "y": 0.078
          },
          "kind": "paragraph",
          "text": "Create a new risk notable that uses your new risk rules are your data sources",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "db6d521e-1e92-463c-83a8-70cfff7b97a5",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.35,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "How It All Works",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "573518d0-67ee-40ca-a8db-79568b47dc1c",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.2,
            "x": 0.05,
            "y": 0.22
          },
          "kind": "title",
          "text": "Okay, so now what?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "e058e90e-d70e-4dfc-9db7-cb1b9849e599",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "Process flow",
            "slug": "process-flow",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4dca-76bc-8135-401836a1c4c0",
            "version": 1,
            "bodyDocId": null,
            "description": "Workflow, steps, sequential diagram.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "1418d7d1-cd43-464a-a4d0-79c3f7f056f2",
          "evidence": "diagram/process: Choose Correlation Searches -> Create ASC Rules -> Create AS Notable",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.572935+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 13,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [
        {
          "matchId": "bfdbbc2d-a5ea-4f30-b1a8-da83c1794177",
          "evidence": "Linear flow of three steps",
          "framework": null,
          "confidence": 0.8,
          "extraction": {
            "at": "2026-05-02 17:04:13.288+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 13,
          "frameworkName": "process"
        }
      ],
      "arcBeats": [
        {
          "to": 13,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 9,
          "name": "Evidence & Proof",
          "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Evidence & Proof",
            "slug": "consultants-gambit-evidence-proof",
            "status": "active",
            "canonId": "019dd9b8-07b1-7688-8e1e-7637fec3802a",
            "version": 1,
            "description": null
          },
          "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
          "position": 2,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Evidence",
            "slug": "evidence",
            "status": "active",
            "canonId": "019dd9b8-03f9-772a-b84a-4f07b415b77a",
            "version": 1,
            "description": "A dedicated proof beat exists in only ~4 arcs (Gambit, Sequoia, AIDA, Monroes). Other arcs embed evidence inline within development."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [
        {
          "to": 13,
          "from": 6,
          "loop": {
            "name": "01_logic_chain",
            "slug": "01-logic-chain",
            "status": "active",
            "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
            "canonId": "019dd956-6638-7457-8650-9b0b42e59fb3",
            "version": 1,
            "bodyDocId": "019df22a-2420-77be-bc41-ded96d08cb21",
            "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
            "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion",
            "familyLabel": null
          },
          "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
          "evidence": "The document presents a logical chain of ideas and benefits.",
          "position": 0,
          "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 21:27:40.487969+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": "doc-narrative-v1"
          }
        }
      ],
      "locked": true
    },
    {
      "page": 14,
      "type": "appendix",
      "title": "The slide explains the technical definition and operational requirements for an ASC within the Splunk ES ecosystem.",
      "function": "present_framework",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "present_framework",
        "functionCanon": {
          "name": "Present framework",
          "slug": "present_framework",
          "status": "active",
          "canonId": "019de52d-1403-7667-9100-d2ac6709f750",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 18,
        "componentCount": 3,
        "textChars": 333,
        "nDataPoints": 0,
        "notes": "The slide explains the technical definition and operational requirements for an ASC within the Splunk ES ecosystem.",
        "elementsJson": [
          "headline_text",
          "bullet_list",
          "numbered_list",
          "photo"
        ],
        "confidence": 0.95,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.318+00",
          "seconds": 2.211,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/14",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-14",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.1,
            "w": 0.45,
            "x": 0.45,
            "y": 0.6
          },
          "kind": "callout",
          "text": "*** NOTE: RULES DO NOT HAVE TO HAVE A RISK SCORE!!! ***",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": null,
            "subkind": {
              "name": "Primary callout",
              "slug": "primary",
              "status": "active",
              "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "primary",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.318+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "9b4da634-086e-4bf6-a9ad-36f89591f8c3",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.6,
            "w": 0.5,
            "x": 0.42,
            "y": 0.15
          },
          "kind": "list",
          "text": "Correlation Search that is used within ES to contribute to an analytic story\nHave a standardized naming convention\nAssign risk to the correlation search in the adaptive response action\nASC rules can be used in more than one AS Notable",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.318+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "106fa326-97cc-447d-9c18-801aefa7cfd1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.4,
            "w": 0.3,
            "x": 0.05,
            "y": 0.15
          },
          "kind": "title",
          "text": "What is an Analytic Story Contributor (ASC)?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.318+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "c531323e-9e74-4cd3-8ea5-a48c1693c137",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "f8475ae0-6540-45f2-8724-9a7deba71115",
          "evidence": "list/bullet: Correlation Search that is used within ES to contribute to an analytic story",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.639886+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 14,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 15,
      "type": "appendix",
      "function": "present_solution",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "present_solution",
        "functionCanon": {
          "name": "Present solution",
          "slug": "present_solution",
          "status": "active",
          "canonId": "019de52d-15b8-71da-bd23-2b767850cbce",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 18,
        "componentCount": 3,
        "textChars": 337,
        "nDataPoints": 0,
        "notes": null,
        "elementsJson": [
          "numbered_list"
        ],
        "confidence": 0.9,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.517+00",
          "seconds": 3.167,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/15",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-15",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.3,
            "w": 0.35,
            "x": 0,
            "y": 0.7
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Photo",
              "slug": "photo",
              "status": "active",
              "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "photo",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.517+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "fefada25-83fa-4870-8cdf-d29175165228",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.7,
            "w": 0.5,
            "x": 0.42,
            "y": 0.15
          },
          "kind": "list",
          "text": "1. Will be based off of the risk index\n2. Will use the source field to limit scope of what you are looking for\n3. Easiest is to put your sources/rule names in a lookup\n4. Can set a threshold for what you are looking for (count of sources, timeframe, etc.)\n5. Make sure your earliest and latest are set properly",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Numbered list",
              "slug": "numbered",
              "status": "active",
              "canonId": "019de52c-fcc0-7718-a284-a4250c805df2",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "numbered",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.517+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a4aa86bf-89b8-44ee-9c3c-5cc0b663ecf1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.2,
            "w": 0.3,
            "x": 0.05,
            "y": 0.15
          },
          "kind": "title",
          "text": "How to Create an AS Notable",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.517+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "5990a825-8ea9-4cd9-8ef4-84cae9333547",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "b6446ed0-7429-4552-8fd0-db28292d0b47",
          "evidence": "list/numbered: 1. Will be based off of the risk index",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.707032+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 15,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 16,
      "type": "appendix",
      "title": "This appears to be a configuration screen from Splunk's Risk-Based Alerting (RBA) feature.",
      "function": "present_solution",
      "rawType": "other",
      "block": null,
      "metadata": {
        "slideType": "other",
        "slideTypeCanon": {
          "name": "Other (fallback)",
          "slug": "other",
          "status": "active",
          "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43",
          "version": 1,
          "description": null
        },
        "function": "present_solution",
        "functionCanon": {
          "name": "Present solution",
          "slug": "present_solution",
          "status": "active",
          "canonId": "019de52d-15b8-71da-bd23-2b767850cbce",
          "version": 1,
          "description": null
        },
        "density": "dense",
        "densityScore": 54,
        "componentCount": 10,
        "textChars": 203,
        "nDataPoints": 0,
        "notes": "This appears to be a configuration screen from Splunk's Risk-Based Alerting (RBA) feature.",
        "elementsJson": [
          "screenshot"
        ],
        "confidence": 0.9,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:11.332+00",
          "seconds": 3.799,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/16",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-16",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.03,
            "w": 0.15,
            "x": 0.15,
            "y": 0.88
          },
          "kind": "list",
          "text": "+ Add Risk Modifier",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f7afa621-2a96-4daa-822c-8525f561fcc1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.85,
            "x": 0.13,
            "y": 0.09
          },
          "kind": "other",
          "text": "User: $user$ Found Doing Something Bad on $src$",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "3dd73896-57fa-4560-b4a1-9dab7ec62ced",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.75,
            "x": 0.19,
            "y": 0.188
          },
          "kind": "other",
          "text": "Risk Score 0",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "41255bbe-2504-414d-84c9-47e0d16caff3",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.75,
            "x": 0.19,
            "y": 0.765
          },
          "kind": "other",
          "text": "Risk Object Type system",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "76800118-9013-4481-b38a-50241c8a051e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.75,
            "x": 0.19,
            "y": 0.65
          },
          "kind": "other",
          "text": "Risk Object Field src",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d1ba75bf-650b-4a11-a4c9-235efa3d05c8",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.75,
            "x": 0.19,
            "y": 0.53
          },
          "kind": "other",
          "text": "Risk Score 0",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d3909b62-a311-47e2-ae0d-ec605e298781",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.75,
            "x": 0.19,
            "y": 0.31
          },
          "kind": "other",
          "text": "Risk Object Field user",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "d8d49472-0902-4656-87b1-7004d3fd407e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.75,
            "x": 0.19,
            "y": 0.425
          },
          "kind": "other",
          "text": "Risk Object Type user",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f2a75267-6f14-42c9-bce1-4f43e8694030",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.11,
            "x": 0.02,
            "y": 0.11
          },
          "kind": "paragraph",
          "text": "Risk Message",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "138da8d0-9818-4e8c-8a5f-d25f3058cb04",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.11,
            "x": 0.02,
            "y": 0.215
          },
          "kind": "paragraph",
          "text": "Risk Modifiers",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.332+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "b3bd101f-3a30-40d9-a398-40ffb3af1b2e",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 17,
      "type": "evidence",
      "title": "The slide uses a dark-mode code block with blue highlights and pink callout boxes to explain specific lines of the query.",
      "function": "illustrate_case",
      "rawType": "client_example",
      "block": null,
      "metadata": {
        "slideType": "client_example",
        "slideTypeCanon": {
          "name": "Client example",
          "slug": "client_example",
          "status": "active",
          "canonId": "019de52d-0c87-77cb-9867-613ae22e95ac",
          "version": 1,
          "description": null
        },
        "function": "illustrate_case",
        "functionCanon": {
          "name": "Illustrate case",
          "slug": "illustrate_case",
          "status": "active",
          "canonId": "019de52d-13b4-772c-bb73-1873612a7463",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 47,
        "componentCount": 6,
        "textChars": 563,
        "nDataPoints": 0,
        "notes": "The slide uses a dark-mode code block with blue highlights and pink callout boxes to explain specific lines of the query.",
        "elementsJson": [
          "headline_text",
          "subtitle_text",
          "screenshot",
          "other"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.896+00",
          "seconds": 3.33,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/17",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-17",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.08,
            "w": 0.4,
            "x": 0.02,
            "y": 0.82
          },
          "kind": "callout",
          "text": "Count of rules and threshold to look for",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": null,
            "subkind": {
              "name": "Primary callout",
              "slug": "primary",
              "status": "active",
              "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "primary",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.896+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "2d59fe06-01f2-49c7-b868-3964eca07ccc",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.4,
            "x": 0.38,
            "y": 0.7
          },
          "kind": "callout",
          "text": "List of rule names, or your lookup name",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": null,
            "subkind": {
              "name": "Primary callout",
              "slug": "primary",
              "status": "active",
              "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "primary",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.896+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "cf5f1766-8f1c-45e9-9a70-0290d5c6b721",
          "parentComponentId": null
        },
        {
          "bbox": null,
          "kind": "callout",
          "text": "This is nice and all, but what does it look like?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Callout",
              "slug": "callout",
              "status": "active",
              "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2",
              "version": 1,
              "description": "Highlighted callout box."
            },
            "tool": {
              "name": "Visual emphasis",
              "slug": "visual-emphasis",
              "status": "active",
              "bestFor": null,
              "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c",
              "version": 1,
              "bodyDocId": null,
              "description": "Drawing the eye to one element above the rest of the slide.",
              "familyLabel": null
            },
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-04-27 15:55:50+00",
            "model": "or:google/gemini-3.1-flash-lite-preview",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "019dd952-d9f3-716a-8f84-72e2d91ec431",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.26,
            "w": 0.96,
            "x": 0.02,
            "y": 0.34
          },
          "kind": "other",
          "text": "index=risk source IN (\"Threat - ASC - Add_or_Set_Windows_Defender_Exclusion - Rule\", \"Threat - ASC - Disabling_Remote_User_Account_Control - Rule\", \"Threat - ASC - Executables_Or_Script_Creation_In_Suspicious_Path - Rule\", \"Threat - ASC - Non Chrome Process Accessing Chrome Default Dir - Rule\") | eventstats dc(source) AS source_count | where source_count >= 2",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Other",
              "slug": "other",
              "status": "active",
              "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d",
              "version": 1,
              "description": "Fallback when no canonical kind applies."
            },
            "tool": null,
            "subkind": {
              "name": "Unclassified",
              "slug": "unclassified",
              "status": "active",
              "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "unclassified",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.896+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "33119b91-7de0-4629-bef9-c5187b18c130",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.03,
            "w": 0.4,
            "x": 0.05,
            "y": 0.21
          },
          "kind": "paragraph",
          "text": "This is nice and all, but what does it look like?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.896+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "4b326a2d-6b49-445d-9bce-08cadcac6f43",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.45,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Example AS Notable Search",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.896+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "1223944f-a6c3-4b10-979b-1732fb853ec3",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 18,
      "type": "resolution",
      "title": "The slide uses a 'big number' layout to emphasize performance metrics.",
      "function": "quantify_impact",
      "rawType": "key_takeaways",
      "block": null,
      "metadata": {
        "slideType": "key_takeaways",
        "slideTypeCanon": {
          "name": "Key takeaways",
          "slug": "key_takeaways",
          "status": "active",
          "canonId": "019de52d-06e7-7674-a891-9f7de3b11b6d",
          "version": 1,
          "description": null
        },
        "function": "quantify_impact",
        "functionCanon": {
          "name": "Quantify impact",
          "slug": "quantify_impact",
          "status": "active",
          "canonId": "019de52d-1630-720d-b57d-fa7f76bebd8d",
          "version": 1,
          "description": null
        },
        "density": "balanced",
        "densityScore": 43,
        "componentCount": 7,
        "textChars": 157,
        "nDataPoints": 4,
        "notes": "The slide uses a 'big number' layout to emphasize performance metrics.",
        "elementsJson": [
          "headline_text",
          "big_number"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.955+00",
          "seconds": 3.225,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/18",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-18",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.2,
            "w": 0.15,
            "x": 0.55,
            "y": 0.45
          },
          "kind": "metric",
          "text": "0% False Positives",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Metric",
              "slug": "metric",
              "status": "active",
              "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d",
              "version": 1,
              "description": "Big-number or KPI value."
            },
            "tool": null,
            "subkind": {
              "name": "Big number",
              "slug": "big-number",
              "status": "active",
              "canonId": "019de52c-fc70-70c8-b965-0584548a9204",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "big-number",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "00db4d68-fc75-4d1f-a443-63133b3c256c",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.3,
            "w": 0.15,
            "x": 0.78,
            "y": 0.38
          },
          "kind": "metric",
          "text": "100% (ish) Happy Analysts",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Metric",
              "slug": "metric",
              "status": "active",
              "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d",
              "version": 1,
              "description": "Big-number or KPI value."
            },
            "tool": null,
            "subkind": {
              "name": "Big number",
              "slug": "big-number",
              "status": "active",
              "canonId": "019de52c-fc70-70c8-b965-0584548a9204",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "big-number",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "5c920c30-af6f-4301-852d-e54fa7182734",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.2,
            "w": 0.15,
            "x": 0.3,
            "y": 0.45
          },
          "kind": "metric",
          "text": "700% Less Alerting Volume",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Metric",
              "slug": "metric",
              "status": "active",
              "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d",
              "version": 1,
              "description": "Big-number or KPI value."
            },
            "tool": null,
            "subkind": {
              "name": "Big number",
              "slug": "big-number",
              "status": "active",
              "canonId": "019de52c-fc70-70c8-b965-0584548a9204",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "big-number",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "64ff6ab4-f806-4e43-9e04-7dc8f53b79e1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.2,
            "w": 0.15,
            "x": 0.08,
            "y": 0.45
          },
          "kind": "metric",
          "text": "75% True Positive Rate",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Metric",
              "slug": "metric",
              "status": "active",
              "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d",
              "version": 1,
              "description": "Big-number or KPI value."
            },
            "tool": null,
            "subkind": {
              "name": "Big number",
              "slug": "big-number",
              "status": "active",
              "canonId": "019de52c-fc70-70c8-b965-0584548a9204",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "big-number",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "999b1337-c40f-4096-9d6e-556b12034006",
          "parentComponentId": null
        },
        {
          "bbox": null,
          "kind": "metric",
          "text": "Analyst satisfaction: 100%",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Metric",
              "slug": "metric",
              "status": "active",
              "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d",
              "version": 1,
              "description": "Big-number or KPI value."
            },
            "tool": {
              "name": "Quantification",
              "slug": "quantification",
              "status": "active",
              "bestFor": null,
              "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88",
              "version": 1,
              "bodyDocId": null,
              "description": "Translating a claim into numbers, charts, or tables.",
              "familyLabel": null
            },
            "subkind": null,
            "framework": null
          },
          "subkind": "primary",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-04-27 07:18:45+00",
            "model": "or:google/gemini-3.1-flash-lite-preview",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "019dd952-832b-73b4-83a8-0497a8147a8f",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.35,
            "x": 0.05,
            "y": 0.15
          },
          "kind": "title",
          "text": "Why Does this Matter?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "acffc990-41b5-406d-8ae8-8556f4a83fcf",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.2,
            "x": 0.05,
            "y": 0.23
          },
          "kind": "title",
          "text": "What's in it for me?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.955+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "e2595d2d-4838-4c37-bc4f-80f94c6d91c9",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 19,
      "type": "setup",
      "title": "The slide uses a three-column layout with icons to represent each objective.",
      "function": "summarize",
      "rawType": "agenda",
      "block": null,
      "metadata": {
        "slideType": "agenda",
        "slideTypeCanon": {
          "name": "Agenda",
          "slug": "agenda",
          "status": "active",
          "canonId": "019de52d-061b-7470-b138-3ffa5e612cce",
          "version": 1,
          "description": null
        },
        "function": "summarize",
        "functionCanon": {
          "name": "Summarize",
          "slug": "summarize",
          "status": "active",
          "canonId": "019de52d-1541-704f-b86f-bf7b75056373",
          "version": 1,
          "description": null
        },
        "density": "dense",
        "densityScore": 63,
        "componentCount": 11,
        "textChars": 363,
        "nDataPoints": 0,
        "notes": "The slide uses a three-column layout with icons to represent each objective.",
        "elementsJson": [
          "headline_text",
          "subtitle_text",
          "icon_grid"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:11.587+00",
          "seconds": 3.839,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/19",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-19",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.18,
            "w": 0.18,
            "x": 0.1,
            "y": 0.47
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Icon grid",
              "slug": "icon-grid",
              "status": "active",
              "canonId": "019de52c-fdfe-749d-9990-1db465a3eed4",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "icon-grid",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "48c41349-ee1c-4f56-a2df-cc67401179dc",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.18,
            "w": 0.18,
            "x": 0.41,
            "y": 0.47
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Icon grid",
              "slug": "icon-grid",
              "status": "active",
              "canonId": "019de52c-fdfe-749d-9990-1db465a3eed4",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "icon-grid",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "dd35789a-910a-4be4-93ff-e4545082d036",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.18,
            "w": 0.18,
            "x": 0.72,
            "y": 0.47
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Icon grid",
              "slug": "icon-grid",
              "status": "active",
              "canonId": "019de52c-fdfe-749d-9990-1db465a3eed4",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "icon-grid",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "ffadf1e8-5c95-4bb7-8bbb-d8862b95bda3",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.68,
            "y": 0.315
          },
          "kind": "list",
          "text": "How AS and RBA can take you to the next level",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "16bcb2b5-8714-4317-a13d-45c5e4a4bdca",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.38,
            "y": 0.315
          },
          "kind": "list",
          "text": "How you can utilize AS in your environment",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "397b3ce9-2d69-4099-a7ac-1d331e6df191",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.07,
            "y": 0.35
          },
          "kind": "list",
          "text": "What are analytic stories (AS)?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a12fe6e3-f733-43cc-8bff-834426ae2a80",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.07,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Define what analytic stories are and how they are found",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "34bcde75-b132-49aa-bee1-38c20b77ac3e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.38,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Discuss how you can utilize AS and RBA to reduce alert fatigue",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "4b312f09-55d3-42cf-8853-b5057f98f550",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.3,
            "x": 0.05,
            "y": 0.22
          },
          "kind": "paragraph",
          "text": "What are you going to get out of this?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "61d33878-321d-48ec-ac33-44389335a8e1",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.25,
            "x": 0.68,
            "y": 0.77
          },
          "kind": "paragraph",
          "text": "Look at how AS can bridge the gap between strictly RBA and 1-1 alerting",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4",
              "version": 1,
              "description": "Single prose block in the body of a slide."
            },
            "tool": null,
            "subkind": {
              "name": "Paragraph",
              "slug": "paragraph",
              "status": "active",
              "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "paragraph",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "b328c1e6-5bc7-4258-bb8a-922d6261706e",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.4,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "Learning Objectives",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:11.587+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "f7006c1c-bd32-4b99-90e8-1e41ccd1bef6",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "3d89e70a-9444-4451-9cea-5e68f59c694d",
          "evidence": "list/bullet: How AS and RBA can take you to the next level",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.874122+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 19,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [
        {
          "to": 19,
          "arc": {
            "name": "The Consultant's Gambit",
            "slug": "consultants-gambit",
            "status": "active",
            "bestFor": "Business cases, project proposals, strategic recommendations",
            "canonId": "019dd956-5e0a-73c8-b305-81c38c959e9c",
            "version": 1,
            "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49",
            "structure": "Situation & Context -> Problem & Complication -> Solution & Approach -> Evidence & Proof -> Impact & Next Steps",
            "description": null,
            "familyLabel": null
          },
          "from": 14,
          "name": "Impact & Next Steps",
          "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
          "matchId": "f19eccad-bafd-40fb-8414-cf322144cb7e",
          "beatType": {
            "name": "Impact & Next Steps",
            "slug": "consultants-gambit-impact-next-steps",
            "status": "active",
            "canonId": "019dd9b8-0849-7728-9ee9-fd1609c4c655",
            "version": 1,
            "description": null
          },
          "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
          "position": 3,
          "isPrimaryArc": true,
          "parentBeatType": {
            "name": "Resolution",
            "slug": "resolution",
            "status": "active",
            "canonId": "019dd9b8-045d-703b-8dd7-e92aba3ba91b",
            "version": 1,
            "description": "How the deck ends. Required in 19/20 arcs. The exception (Sparkline) ends with new bliss which is functionally a resolution."
          },
          "alignedBlockIds": null,
          "matchConfidence": 0.8
        }
      ],
      "loops": [],
      "locked": true
    },
    {
      "page": 20,
      "type": "setup",
      "title": "The slide uses a collage-style illustration with a person, a dog, a sunflower, and butterflies.",
      "function": "state_next_steps",
      "rawType": "closing_ask",
      "block": null,
      "metadata": {
        "slideType": "closing_ask",
        "slideTypeCanon": {
          "name": "Closing ask",
          "slug": "closing_ask",
          "status": "active",
          "canonId": "019de52d-0aa4-750f-8aa1-8d622dd99f5c",
          "version": 1,
          "description": null
        },
        "function": "state_next_steps",
        "functionCanon": {
          "name": "State next steps",
          "slug": "state_next_steps",
          "status": "active",
          "canonId": "019de52d-14ca-70ac-b534-971f458cdf29",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 5,
        "componentCount": 3,
        "textChars": 21,
        "nDataPoints": 0,
        "notes": "The slide uses a collage-style illustration with a person, a dog, a sunflower, and butterflies.",
        "elementsJson": [
          "photo"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:10.378+00",
          "seconds": 2.619,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/20",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-20",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.02,
            "w": 0.08,
            "x": 0.01,
            "y": 0.01
          },
          "kind": "disclaimer",
          "text": "© 2023 SPLUNK INC.",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Disclaimer",
              "slug": "disclaimer",
              "status": "active",
              "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc",
              "version": 1,
              "description": "Legal/cautionary text that occupies most of the body of its slide."
            },
            "tool": null,
            "subkind": null,
            "framework": null
          },
          "subkind": null,
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.378+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "a2b25450-ae81-43f2-826e-ee9cdd805110",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.85,
            "w": 0.4,
            "x": 0.55,
            "y": 0.068
          },
          "kind": "image",
          "text": null,
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Illustration",
              "slug": "illustration",
              "status": "active",
              "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "illustration",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.378+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "2ea454b4-9b8e-4d91-80bf-2b0aaecaf7e8",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.218,
            "w": 0.195,
            "x": 0.057,
            "y": 0.125
          },
          "kind": "title",
          "text": "Q&A",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:10.378+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "7529f1a5-4cb5-4795-9d06-5a630fb7c5f0",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [],
      "loops": [],
      "locked": true
    },
    {
      "page": 21,
      "type": "appendix",
      "function": "summarize",
      "rawType": "appendix",
      "block": null,
      "metadata": {
        "slideType": "appendix",
        "slideTypeCanon": {
          "name": "Appendix",
          "slug": "appendix",
          "status": "active",
          "canonId": "019de52d-0762-71f8-b564-89ab863301cc",
          "version": 1,
          "description": null
        },
        "function": "summarize",
        "functionCanon": {
          "name": "Summarize",
          "slug": "summarize",
          "status": "active",
          "canonId": "019de52d-1541-704f-b86f-bf7b75056373",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 20,
        "componentCount": 3,
        "textChars": 381,
        "nDataPoints": 0,
        "notes": null,
        "elementsJson": [
          "headline_text",
          "bullet_list"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.848+00",
          "seconds": 2.079,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/21",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-21",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.3,
            "w": 0.9,
            "x": 0.05,
            "y": 0.35
          },
          "kind": "list",
          "text": "Splunk Lantern Article: Implementing risk-based alerting\n.Conf 2022 Talk: Curating Your Risk Ecology: Making Risk Based Alerting Magick\n.Conf 2021 Talk: Supercharge your risk-based alerting (RBA) implementation\n.Conf 2020 Talk: Full speed ahead with risk-based alerting (RBA)\n.Conf 2019 Talk: Getting started with risk-based alerting and MITRE",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "List",
              "slug": "list",
              "status": "active",
              "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2",
              "version": 1,
              "description": "Bullet or numbered list."
            },
            "tool": null,
            "subkind": {
              "name": "Bullet list",
              "slug": "bullet",
              "status": "active",
              "canonId": "019de52c-fc98-7169-a083-5cab805076ca",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "bullet",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.848+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "20f87b01-1ed0-42a7-8d32-618af8fb8765",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.08,
            "w": 0.35,
            "x": 0.05,
            "y": 0.14
          },
          "kind": "title",
          "text": "What is RBA?",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.848+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "9236db5b-8a29-4d80-87a3-b6311237e31d",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.04,
            "w": 0.35,
            "x": 0.05,
            "y": 0.23
          },
          "kind": "title",
          "text": "Excellent Resources on RBA",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Subtitle",
              "slug": "subtitle",
              "status": "active",
              "canonId": "019de52c-fb09-739d-900c-815b0d9ac526",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "subtitle",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.848+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "37ffa08f-5e42-41d3-8834-44cadc18e107",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [
        {
          "tool": {
            "name": "List presentation",
            "slug": "list-presentation",
            "status": "active",
            "bestFor": null,
            "canonId": "019dd9e1-4ef7-777d-ba68-9074c2b3bcf1",
            "version": 1,
            "bodyDocId": null,
            "description": "Bulleted, numbered, or checklist enumerations.",
            "familyLabel": null,
            "categoryName": null,
            "categorySlug": null
          },
          "agent": null,
          "layer": "slide",
          "agents": null,
          "matchId": "f5913e6c-0592-4346-bc0d-8fab6cc1f513",
          "evidence": "list/bullet: Splunk Lantern Article: Implementing risk-based alerting",
          "pageRefs": null,
          "priority": null,
          "whenToUse": null,
          "confidence": 0.7,
          "extraction": {
            "at": "2026-07-16 22:14:18.974511+00",
            "model": "or:meta-llama/llama-4-scout",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "pageNumber": 21,
          "whyItWorks": null,
          "antipattern": null,
          "cardinality": "common",
          "narrativePurpose": null
        }
      ],
      "frameworks": [],
      "arcBeats": [],
      "loops": [],
      "locked": true
    },
    {
      "page": 22,
      "type": "setup",
      "title": "This is a standard closing slide for a Splunk conference presentation.",
      "function": "transition",
      "rawType": "closing_ask",
      "block": null,
      "metadata": {
        "slideType": "closing_ask",
        "slideTypeCanon": {
          "name": "Closing ask",
          "slug": "closing_ask",
          "status": "active",
          "canonId": "019de52d-0aa4-750f-8aa1-8d622dd99f5c",
          "version": 1,
          "description": null
        },
        "function": "transition",
        "functionCanon": {
          "name": "Transition",
          "slug": "transition",
          "status": "active",
          "canonId": "019de52d-1365-7149-92aa-66df859e75fd",
          "version": 1,
          "description": null
        },
        "density": "sparse",
        "densityScore": 7,
        "componentCount": 3,
        "textChars": 78,
        "nDataPoints": 0,
        "notes": "This is a standard closing slide for a Splunk conference presentation.",
        "elementsJson": [
          "headline_text",
          "photo",
          "logo_grid"
        ],
        "confidence": 1,
        "extraction": {
          "model": "google/gemini-3.1-flash-lite-preview-20260303",
          "runId": null,
          "at": "2026-05-02 17:04:09.735+00",
          "seconds": 1.921,
          "promptVersion": "v2-canon-conditioned"
        }
      },
      "links": {
        "slide": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/22",
        "deck": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
        "deckAnchor": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-22",
        "deckJson": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json"
      },
      "components": [
        {
          "bbox": {
            "h": 0.5,
            "w": 1,
            "x": 0,
            "y": 0.4
          },
          "kind": "image",
          "text": "Collage of landmarks, people, and surreal elements",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Illustration",
              "slug": "illustration",
              "status": "active",
              "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "illustration",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.735+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "1f41b846-9407-4d14-8d2d-16ff7463f36a",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.06,
            "w": 0.14,
            "x": 0.85,
            "y": 0.92
          },
          "kind": "image",
          "text": "Splunk .conf23 logo",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Image",
              "slug": "image",
              "status": "active",
              "canonId": "019de52c-f978-701f-a720-51d029d769e7",
              "version": 1,
              "description": "Photo, illustration, screenshot or icon."
            },
            "tool": null,
            "subkind": {
              "name": "Logo",
              "slug": "logo",
              "status": "active",
              "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "logo",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.735+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "1218fbc5-891c-427e-9784-993e0f154bfc",
          "parentComponentId": null
        },
        {
          "bbox": {
            "h": 0.15,
            "w": 0.52,
            "x": 0.24,
            "y": 0.18
          },
          "kind": "title",
          "text": "Thank You",
          "attrs": null,
          "canon": {
            "kind": {
              "name": "Title",
              "slug": "title",
              "status": "active",
              "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4",
              "version": 1,
              "description": "Slide title or headline."
            },
            "tool": null,
            "subkind": {
              "name": "Headline",
              "slug": "headline",
              "status": "active",
              "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d",
              "version": 1,
              "description": null
            },
            "framework": null
          },
          "subkind": "headline",
          "groupRole": null,
          "confidence": null,
          "extraction": {
            "at": "2026-05-02 17:04:09.735+00",
            "model": "google/gemini-3.1-flash-lite-preview-20260303",
            "runId": null,
            "seconds": null,
            "promptVersion": null
          },
          "componentId": "11751ea5-3703-4756-8016-89766fe48a58",
          "parentComponentId": null
        }
      ],
      "metrics": [],
      "tools": [],
      "frameworks": [],
      "arcBeats": [],
      "loops": [],
      "locked": true
    }
  ],
  "arcBeats": [
    {
      "from": 1,
      "to": 5,
      "label": "Situation & Context",
      "description": "The document provides an introduction to the topic and sets the agenda."
    },
    {
      "from": 6,
      "to": 8,
      "label": "Problem & Complication",
      "description": "The document explains the need for more effective analytics and risk management."
    },
    {
      "from": 9,
      "to": 13,
      "label": "Evidence & Proof",
      "description": "The document provides examples and explanations of Analytic Stories and RBA."
    },
    {
      "from": 14,
      "to": 19,
      "label": "Impact & Next Steps",
      "description": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA."
    }
  ],
  "loops": [
    {
      "from": 6,
      "to": 13,
      "label": "Logic Chain",
      "description": "To understand the logic and benefits of using Analytic Stories and RBA"
    }
  ]
}