{
  "docId": "019dd923-5eff-723e-9be5-94b010d7889b",
  "docSlug": "d014079089cef381",
  "documentTitle": "2023 conf SEC1402A",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 12,
  "pageCount": 22,
  "prevPage": 11,
  "nextPage": 13,
  "slideType": "diagnosis",
  "function": "present_framework",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide uses callout boxes to label specific UI elements of a Splunk dashboard, effectively acting as a legend or guide for the software interface.",
  "elementsJson": [
    "headline_text",
    "process_diagram",
    "bullet_list"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/12",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-12",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-832b-73b4-83a8-9c87a4300bdc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.72,
        "w": 0.84,
        "x": 0.08,
        "y": 0.235
      },
      "kind": "image",
      "text": "Splunk Security Essentials interface",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "eb04f887-5cba-417e-8e77-25a4c2764fe0",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.5,
        "w": 0.75,
        "x": 0.12,
        "y": 0.25
      },
      "kind": "legend",
      "text": "Name of AS, Category, All CS related to AS, Data Sources Used, Sourcetypes, Lookups Used, Data Models Used",
      "attrs": null,
      "subkind": null,
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9e814d27-02f9-4f0a-a5b7-623bf8946229",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.25,
        "x": 0.05,
        "y": 0.14
      },
      "kind": "title",
      "text": "Let's Break It Down",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "a31aeb4b-b4e6-4c05-b1a5-1db110088481",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [
    {
      "name": "Legend / context",
      "slug": "legend-context",
      "agent": null,
      "layer": "slide",
      "matchId": "a6b6bbf1-0f47-41cd-80eb-d9a970c5ba42",
      "evidence": "legend: Name of AS, Category, All CS related to AS, Data Sources Used, Sourcetypes, Lookups Used, Data Models Used",
      "confidence": 0.7
    }
  ],
  "frameworks": [
    {
      "name": "annotation",
      "slug": null,
      "matchId": "3daed76a-1c00-4637-bac9-246b53defc75",
      "evidence": "The slide uses callout boxes to label parts of a screenshot.",
      "confidence": 0.9
    }
  ],
  "arcBeats": [
    {
      "to": 13,
      "from": 9,
      "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Evidence & Proof",
      "beatSlug": "consultants-gambit-evidence-proof",
      "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Evidence",
      "parentBeatSlug": "evidence"
    }
  ],
  "loops": [
    {
      "to": 13,
      "from": 6,
      "name": "Logic Chain",
      "slug": "01-logic-chain",
      "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
      "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
      "evidence": "The document presents a logical chain of ideas and benefits.",
      "position": 0,
      "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
      "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
      "confidence": 0.7,
      "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}