{
  "docId": "019dd923-5eff-723e-9be5-920f70c17c85",
  "docSlug": "c5cd5f7c0292fe57",
  "documentTitle": "2023 conf SEC1096C",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 44,
  "pageCount": 52,
  "prevPage": 43,
  "nextPage": 45,
  "slideType": "data_table",
  "function": "analyze_data",
  "density": "sparse",
  "nDataPoints": 0,
  "notes": "The slide uses network diagrams to visualize alert coverage across the MITRE framework.",
  "elementsJson": [
    "headline_text",
    "flowchart"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-920f70c17c85/44",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-920f70c17c85#slide-44",
  "components": [
    {
      "bbox": {
        "h": 0.5,
        "w": 0.4,
        "x": 0.52,
        "y": 0.4
      },
      "kind": "chart",
      "text": "Network diagram of alerts by technique",
      "attrs": null,
      "subkind": "dot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "27c9c0ab-cc1f-4ddb-963a-9cc32982b3b3",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.5,
        "w": 0.4,
        "x": 0.05,
        "y": 0.4
      },
      "kind": "chart",
      "text": "Network diagram of alerts by tactic",
      "attrs": null,
      "subkind": "dot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "995cfd65-ec56-4054-aaea-7ec50f8f5932",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.4,
        "x": 0.05,
        "y": 0.13
      },
      "kind": "title",
      "text": "MITRE ATT&CK Density",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "3257e9dc-ab29-4a19-930b-f95f8bcef7a3",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.35,
        "x": 0.05,
        "y": 0.31
      },
      "kind": "title",
      "text": "Advanced Analytics RBA Alerts by Tactic",
      "attrs": null,
      "subkind": "subtitle",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "40a59741-9759-42e3-b6d3-9ded1c8227ab",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.35,
        "x": 0.52,
        "y": 0.31
      },
      "kind": "title",
      "text": "Advanced Analytics RBA Alerts by Technique",
      "attrs": null,
      "subkind": "subtitle",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d9d5b83d-72bc-40a8-b83c-334d47393bbc",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "MITRE ATT&CK",
      "slug": null,
      "matchId": "a08933e7-3d07-48d0-bb26-d00778918a4e",
      "evidence": "Slide title and content reference MITRE ATT&CK framework",
      "confidence": 1
    }
  ],
  "arcBeats": [
    {
      "to": 52,
      "from": 31,
      "beatId": "5fb02f79-ff5e-4732-ae1a-78f1033c9335",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Impact & Next Steps",
      "beatSlug": "consultants-gambit-impact-next-steps",
      "evidence": "The deck concludes with key takeaways, a client example, and a call to action.",
      "position": 3,
      "confidence": 0.8,
      "parentBeatName": "Resolution",
      "parentBeatSlug": "resolution"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}