{
  "docId": "019dd923-5eff-723e-9be5-94b010d7889b",
  "docSlug": "d014079089cef381",
  "documentTitle": "2023 conf SEC1402A",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 13,
  "pageCount": 22,
  "prevPage": 12,
  "nextPage": 14,
  "slideType": "implementation_plan",
  "function": "plan_implementation",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide uses a simple linear process flow diagram.",
  "elementsJson": [
    "headline_text",
    "process_diagram"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/13",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-13",
  "components": [
    {
      "bbox": {
        "h": 0.3,
        "w": 0.8,
        "x": 0.1,
        "y": 0.045
      },
      "kind": "diagram",
      "text": "Choose Correlation Searches -> Create ASC Rules -> Create AS Notable",
      "attrs": null,
      "subkind": "process",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "780d1373-c7bd-45be-acf5-26d6fad779f1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.08,
        "y": 0.078
      },
      "kind": "paragraph",
      "text": "Decide which correlation searches you want to run for your AS",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "153de6c5-7bd7-46b6-8d10-6d4ebf0a8997",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.38,
        "y": 0.078
      },
      "kind": "paragraph",
      "text": "Convert those searches to a risk rule",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2fe55b6b-388d-4bee-82f0-455414af6b72",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.2,
        "x": 0.68,
        "y": 0.078
      },
      "kind": "paragraph",
      "text": "Create a new risk notable that uses your new risk rules are your data sources",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "db6d521e-1e92-463c-83a8-70cfff7b97a5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.35,
        "x": 0.05,
        "y": 0.14
      },
      "kind": "title",
      "text": "How It All Works",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "573518d0-67ee-40ca-a8db-79568b47dc1c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.04,
        "w": 0.2,
        "x": 0.05,
        "y": 0.22
      },
      "kind": "title",
      "text": "Okay, so now what?",
      "attrs": null,
      "subkind": "subtitle",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "e058e90e-d70e-4dfc-9db7-cb1b9849e599",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [
    {
      "name": "Process flow",
      "slug": "process-flow",
      "agent": null,
      "layer": "slide",
      "matchId": "1418d7d1-cd43-464a-a4d0-79c3f7f056f2",
      "evidence": "diagram/process: Choose Correlation Searches -> Create ASC Rules -> Create AS Notable",
      "confidence": 0.7
    }
  ],
  "frameworks": [
    {
      "name": "process",
      "slug": null,
      "matchId": "bfdbbc2d-a5ea-4f30-b1a8-da83c1794177",
      "evidence": "Linear flow of three steps",
      "confidence": 0.8
    }
  ],
  "arcBeats": [
    {
      "to": 13,
      "from": 9,
      "beatId": "84cf5dd4-3a19-4a52-9eff-fb60d6c7731f",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Evidence & Proof",
      "beatSlug": "consultants-gambit-evidence-proof",
      "evidence": "The document provides examples and explanations of Analytic Stories and RBA.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": "Evidence",
      "parentBeatSlug": "evidence"
    }
  ],
  "loops": [
    {
      "to": 13,
      "from": 6,
      "name": "Logic Chain",
      "slug": "01-logic-chain",
      "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
      "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
      "evidence": "The document presents a logical chain of ideas and benefits.",
      "position": 0,
      "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
      "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
      "confidence": 0.7,
      "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}