{
  "docId": "019de50f-8c18-7287-bb05-8c4d63b5eb45",
  "docSlug": "1b92768d704efb3c3b408f7fc7734885",
  "documentTitle": "Crowdstrike | Investor Day Presentation Deck | 23 slides",
  "authorId": "crowdstrike",
  "authorName": "Crowdstrike",
  "documentKindSlug": "conference-presentation",
  "documentKindLabel": "Conference presentation",
  "sourceTypeSlug": "investor_relations",
  "sourceTypeLabel": "Investor relations",
  "presentationDate": "2020-02-01 00:00:00",
  "orientation": "landscape",
  "aspectRatio": 1.7777778,
  "pageNumber": 15,
  "pageCount": 23,
  "prevPage": 14,
  "nextPage": 16,
  "slideType": "comparison_table",
  "function": "present_framework",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "The slide uses a process flow on the left to define IOAs and a comparison box on the right to contrast them with IOCs.",
  "elementsJson": null,
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019de50f-8c18-7287-bb05-8c4d63b5eb45/15",
  "deckHref": "/decks/019de50f-8c18-7287-bb05-8c4d63b5eb45",
  "deckJsonHref": "/decks/019de50f-8c18-7287-bb05-8c4d63b5eb45.json",
  "deckAnchorHref": "/decks/019de50f-8c18-7287-bb05-8c4d63b5eb45#slide-15",
  "components": [
    {
      "bbox": {
        "h": 0.2,
        "w": 0.32,
        "x": 0.64,
        "y": 0.7
      },
      "kind": "callout",
      "text": "IOCs: Malware, Signatures, Exploits, Vulnerabilities, IP Addresses",
      "attrs": null,
      "subkind": "primary",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9e448150-2088-4be3-8213-f255c12c1486",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.2,
        "w": 0.32,
        "x": 0.64,
        "y": 0.3
      },
      "kind": "callout",
      "text": "INDICATORS OF ATTACK: Code Execution, Persistence, Stealth, Command Control, Lateral Movement",
      "attrs": null,
      "subkind": "primary",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "f5054654-a02e-49ac-9d2e-b3c4f365ba49",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.45,
        "w": 0.46,
        "x": 0.09,
        "y": 0.35
      },
      "kind": "diagram",
      "text": "Process executes, enumerates file system, deletes backups, calls encryption routine",
      "attrs": null,
      "subkind": "process",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "7cb43210-ee49-4e9c-9396-a7134cc0ef82",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.07,
        "w": 0.28,
        "x": 0.66,
        "y": 0.53
      },
      "kind": "paragraph",
      "text": "PROACTIVE INDICATORS OF ATTACK VS REACTIVE INDICATORS OF COMPROMISE",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "16dda166-adac-4189-b117-99ac4d0485cf",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.54,
        "x": 0.23,
        "y": 0.12
      },
      "kind": "title",
      "text": "INDICATORS OF ATTACK (IOA)",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9a9c0473-40e9-4bf0-869f-085fea9a0021",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "comparison_frame",
      "slug": null,
      "matchId": "e7cd544d-f17b-41c0-af68-95067fc29e7a",
      "evidence": "The slide explicitly contrasts IOAs and IOCs using a vs. structure.",
      "confidence": 0.9
    }
  ],
  "arcBeats": [],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}