{
  "docId": "019dd923-5eff-723e-9be5-94b010d7889b",
  "docSlug": "d014079089cef381",
  "documentTitle": "2023 conf SEC1402A",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 17,
  "pageCount": 22,
  "prevPage": 16,
  "nextPage": 18,
  "slideType": "client_example",
  "function": "illustrate_case",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide uses a dark-mode code block with blue highlights and pink callout boxes to explain specific lines of the query.",
  "elementsJson": [
    "headline_text",
    "subtitle_text",
    "screenshot",
    "other"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/17",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-17",
  "components": [
    {
      "bbox": {
        "h": 0.08,
        "w": 0.4,
        "x": 0.02,
        "y": 0.82
      },
      "kind": "callout",
      "text": "Count of rules and threshold to look for",
      "attrs": null,
      "subkind": "primary",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "2d59fe06-01f2-49c7-b868-3964eca07ccc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.08,
        "w": 0.4,
        "x": 0.38,
        "y": 0.7
      },
      "kind": "callout",
      "text": "List of rule names, or your lookup name",
      "attrs": null,
      "subkind": "primary",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "cf5f1766-8f1c-45e9-9a70-0290d5c6b721",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "callout",
      "text": "This is nice and all, but what does it look like?",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-d9f3-716a-8f84-72e2d91ec431",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.26,
        "w": 0.96,
        "x": 0.02,
        "y": 0.34
      },
      "kind": "other",
      "text": "index=risk source IN (\"Threat - ASC - Add_or_Set_Windows_Defender_Exclusion - Rule\", \"Threat - ASC - Disabling_Remote_User_Account_Control - Rule\", \"Threat - ASC - Executables_Or_Script_Creation_In_Suspicious_Path - Rule\", \"Threat - ASC - Non Chrome Process Accessing Chrome Default Dir - Rule\") | eventstats dc(source) AS source_count | where source_count >= 2",
      "attrs": null,
      "subkind": "unclassified",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "33119b91-7de0-4629-bef9-c5187b18c130",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.4,
        "x": 0.05,
        "y": 0.21
      },
      "kind": "paragraph",
      "text": "This is nice and all, but what does it look like?",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4b326a2d-6b49-445d-9bce-08cadcac6f43",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.45,
        "x": 0.05,
        "y": 0.14
      },
      "kind": "title",
      "text": "Example AS Notable Search",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "1223944f-a6c3-4b10-979b-1732fb853ec3",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 19,
      "from": 14,
      "beatId": "ff966912-487e-4b37-b06e-6bdc4bc071f2",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Impact & Next Steps",
      "beatSlug": "consultants-gambit-impact-next-steps",
      "evidence": "The document discusses the benefits and key takeaways of using Analytic Stories and RBA.",
      "position": 3,
      "confidence": 0.8,
      "parentBeatName": "Resolution",
      "parentBeatSlug": "resolution"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}