Source: https://conf.splunk.com/files/2021/slides/SEC1271A.pdf