{
  "docId": "019dd923-5eff-723e-9be5-920f70c17c85",
  "docSlug": "c5cd5f7c0292fe57",
  "documentTitle": "2023 conf SEC1096C",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 30,
  "pageCount": 52,
  "prevPage": 29,
  "nextPage": 31,
  "slideType": "other",
  "function": "present_framework",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide shows a list of technical fields (e.g., certificate_common_name, process_hash) and a UI snippet for configuring Risk Analysis in Splunk.",
  "elementsJson": [
    "headline_text",
    "bullet_list",
    "screenshot"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/30",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-30",
  "components": [
    {
      "bbox": {
        "h": 0.45,
        "w": 0.435,
        "x": 0.409,
        "y": 0.46
      },
      "kind": "image",
      "text": "Adaptive Response Actions UI",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "49775e02-7fcf-45ee-ba09-e44b95e22987",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.45,
        "w": 0.2,
        "x": 0.64,
        "y": 0.08
      },
      "kind": "list",
      "text": "http_user_agent, parent_process, parent_process_name, process, process_hash, process_name, registry_path, registry_value_name, registry_value_text, service, url",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5cfb4c36-a7e6-40b3-95d3-39f65715fbd0",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.45,
        "w": 0.2,
        "x": 0.42,
        "y": 0.08
      },
      "kind": "list",
      "text": "certificate_common_name, certificate_organization, certificate_serial, certificate_unit, command, domain, email, email_subject, file_hash, file_name",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "6294c805-1e07-4570-988b-73bf3e26262c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.2,
        "x": 0.05,
        "y": 0.53
      },
      "kind": "paragraph",
      "text": "| inputlookup common_threat_objects.csv",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "c66c1667-156d-4374-ba42-966ff665ffaf",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.25,
        "w": 0.25,
        "x": 0.05,
        "y": 0.12
      },
      "kind": "title",
      "text": "Common Threat Objects",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "b5fcdcd6-bdce-4d79-a34e-ce761865635e",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 30,
      "from": 15,
      "beatId": "4a1785fb-d2ab-4389-afe8-e065ce0f3fc4",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Solution & Approach",
      "beatSlug": "consultants-gambit-solution-approach",
      "evidence": "The deck provides a risk-based approach and strategy for success.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Turn",
      "parentBeatSlug": "turn"
    }
  ],
  "loops": [
    {
      "to": 30,
      "from": 27,
      "name": "Mece Breakdown",
      "slug": "40-mece-breakdown",
      "bestFor": "Problem structuring, ensuring completeness, strategic analysis",
      "matchId": "fa00c30c-a6e2-4753-99a8-3b70d5c72699",
      "evidence": "The deck provides a MECE breakdown of risk score and detection portfolio.",
      "position": 1,
      "objective": "How can teams break down their risk score and detection portfolio?",
      "structure": "The Whole -> Category A (distinct) -> Category B (distinct) -> Category C (distinct) -> Complete Coverage",
      "confidence": 0.6,
      "description": "Divide a complex topic into mutually exclusive, collectively exhaustive categories"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}