Source: https://www.somerfordassociates.com/blog/optimising-risk-based-alerting-with-splunk-enterprise-security/.pdf