{
  "docId": "019dd923-5eff-723e-9be5-920f70c17c85",
  "docSlug": "c5cd5f7c0292fe57",
  "documentTitle": "2023 conf SEC1096C",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 36,
  "pageCount": 52,
  "prevPage": 35,
  "nextPage": 37,
  "slideType": "diagnosis",
  "function": "present_framework",
  "density": "dense",
  "nDataPoints": 1,
  "notes": "The slide uses a visual equation to explain the risk scoring methodology.",
  "elementsJson": [
    "headline_text",
    "paragraph",
    "icon_grid",
    "other"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/36",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-36",
  "components": [
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.29,
        "y": 0.77
      },
      "kind": "list",
      "text": "Impact: How bad would it be if this is a true positive?",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5c954531-a000-42b1-9142-648add25259c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.53,
        "y": 0.77
      },
      "kind": "list",
      "text": "MITRE ATT&CK / Disposition Trending: How important is the TTP and/or are events trending TP/FP",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "787b80fa-68d0-45a1-a682-a04b4a0eff68",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.05,
        "y": 0.77
      },
      "kind": "list",
      "text": "Confidence: How sure are you the event is what you think it should be? FP vs TP",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9a71ab30-26ea-4694-8833-3a78d1032472",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.77,
        "y": 0.77
      },
      "kind": "list",
      "text": "Risk Score: Risk Score assigned to event",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "f963144c-7a43-4645-b83f-f5c914f5c586",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.15,
        "x": 0.31,
        "y": 0.48
      },
      "kind": "metric",
      "text": "High",
      "attrs": null,
      "subkind": "big-number",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1176563c-b733-4d2b-be74-154ea70fbb85",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.15,
        "x": 0.55,
        "y": 0.48
      },
      "kind": "metric",
      "text": "1.5",
      "attrs": null,
      "subkind": "big-number",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "379fb7fe-a556-433b-b0b1-c6d4596de398",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.15,
        "x": 0.07,
        "y": 0.48
      },
      "kind": "metric",
      "text": "Medium",
      "attrs": null,
      "subkind": "big-number",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3fd354bb-93f8-44ed-8aef-c5ef06663168",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.15,
        "x": 0.79,
        "y": 0.48
      },
      "kind": "metric",
      "text": "85",
      "attrs": null,
      "subkind": "big-number",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "456dab18-aae6-4f7f-bc0c-b8c806cc56f4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "metric",
      "text": "Risk Score: 85",
      "attrs": null,
      "subkind": "primary",
      "toolName": "Quantification",
      "toolSlug": "quantification",
      "confidence": null,
      "componentId": "019dd952-832b-73b4-83a5-a7ca529bc032",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.2,
        "x": 0.05,
        "y": 0.21
      },
      "kind": "paragraph",
      "text": "Let's do some math...",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "af6aefd9-bcad-43c9-8f20-0d79f0013d16",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.35,
        "x": 0.05,
        "y": 0.14
      },
      "kind": "title",
      "text": "Advanced Risk Score",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "68078d8a-6492-4d50-8773-05a11f5c9eca",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "Risk Scoring Model",
      "slug": null,
      "matchId": "ab87d66b-bd58-4c45-845f-7b2bec6a3161",
      "evidence": "Formulaic representation of risk score components",
      "confidence": 0.9
    }
  ],
  "arcBeats": [
    {
      "to": 52,
      "from": 31,
      "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Impact & Next Steps",
      "beatSlug": "consultants-gambit-impact-next-steps",
      "evidence": "The deck concludes with key takeaways, a client example, and a call to action.",
      "position": 3,
      "confidence": 0.8,
      "parentBeatName": "Resolution",
      "parentBeatSlug": "resolution"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}