{
  "docId": "019dd923-5eff-723e-9be5-94b010d7889b",
  "docSlug": "d014079089cef381",
  "documentTitle": "2023 conf SEC1402A",
  "authorId": "Splunk",
  "authorName": "Splunk",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 6,
  "pageCount": 22,
  "prevPage": 5,
  "nextPage": 7,
  "slideType": "other",
  "function": "present_framework",
  "density": "dense",
  "nDataPoints": 0,
  "notes": "The slide uses a linear process flow to describe the RBA lifecycle.",
  "elementsJson": [
    "headline_text",
    "process_diagram"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5eff-723e-9be5-94b010d7889b/6",
  "deckHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b",
  "deckJsonHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b.json",
  "deckAnchorHref": "/decks/019dd923-5eff-723e-9be5-94b010d7889b#slide-6",
  "components": [
    {
      "bbox": {
        "h": 0.2,
        "w": 0.9,
        "x": 0.05,
        "y": 0.45
      },
      "kind": "diagram",
      "text": "Search -> Risk Rules (RR) -> Risk Index -> Risk Notable (RN) -> Incident Review",
      "attrs": null,
      "subkind": "process",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5e8f54c7-124d-496e-80e1-bb196e62b7e5",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.8,
        "y": 0.7
      },
      "kind": "paragraph",
      "text": "Risk Notables are then populated into Incident Review for analysts to investigate",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "36ab76c1-f8ac-49d5-9cf0-e6891f7033f9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.42,
        "y": 0.7
      },
      "kind": "paragraph",
      "text": "As badness is found, it is written to the risk index",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "76debe85-2946-42ed-9f1a-9aa322879b32",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.23,
        "y": 0.7
      },
      "kind": "paragraph",
      "text": "Create a new risk rule as a correlation search",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "b13a1d1c-1cf8-4b96-bcfa-60f5581d804e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.05,
        "y": 0.7
      },
      "kind": "paragraph",
      "text": "Run your search within Splunk ES to find what you're looking for",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d513926f-d4eb-4c26-8ab6-c69e43b70f81",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.1,
        "w": 0.15,
        "x": 0.61,
        "y": 0.7
      },
      "kind": "paragraph",
      "text": "Create a risk notable looking for \"risky\" behavior based off the the RR",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d6705a49-3fe7-472a-ab1d-8b45b305ac4c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.06,
        "w": 0.25,
        "x": 0.05,
        "y": 0.14
      },
      "kind": "title",
      "text": "What is RBA?",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "0bde931d-5a9e-4622-91a6-240509efd52e",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.25,
        "x": 0.05,
        "y": 0.21
      },
      "kind": "title",
      "text": "How RBA works within Splunk ES",
      "attrs": null,
      "subkind": "subtitle",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "c672deec-3e18-475d-aef6-b44db6f813c7",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [
    {
      "name": "Process flow",
      "slug": "process-flow",
      "agent": null,
      "layer": "slide",
      "matchId": "99adf656-d2a2-4dd2-81e4-a21bd62db4db",
      "evidence": "Search -> Risk Rules (RR) -> Risk Index -> Risk Notable (RN) -> Incident Review",
      "confidence": 0.7
    }
  ],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 8,
      "from": 6,
      "beatId": "f012b7af-449e-4325-b653-776f4b56c119",
      "arcName": "The Consultant's Gambit",
      "arcSlug": "consultants-gambit",
      "beatName": "Problem & Complication",
      "beatSlug": "consultants-gambit-problem-complication",
      "evidence": "The document explains the need for more effective analytics and risk management.",
      "position": 1,
      "confidence": 0.8,
      "parentBeatName": "Complication",
      "parentBeatSlug": "complication"
    }
  ],
  "loops": [
    {
      "to": 13,
      "from": 6,
      "name": "Logic Chain",
      "slug": "01-logic-chain",
      "bestFor": "Skeptical audiences, controversial recommendations, rigorous analysis",
      "matchId": "9af8f130-d257-4a23-a168-0998e434eb6e",
      "evidence": "The document presents a logical chain of ideas and benefits.",
      "position": 0,
      "objective": "To understand the logic and benefits of using Analytic Stories and RBA",
      "structure": "Premise 1 (Accepted truth) -> Premise 2 (Observed fact) -> Therefore... (Inevitable conclusion)",
      "confidence": 0.7,
      "description": "Build an airtight chain of logic where each premise leads inevitably to the conclusion"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}