Source: https://www.splunk.com/en_us/pdfs/tech-brief/risk-based-alerting-helps-socs-focus-on-what-really-matters.pdf