Source: https://conf.splunk.com/files/2020/slides/SEC1623C.pdf