html{--info-icon: url('https://beta.splunkresearch.com/icons/info.svg');--sun-icon: url('https://beta.splunkresearch.com/icons/sun.svg');--moon-icon: url('https://beta.splunkresearch.com/icons/moon.svg');--next-icon: url('https://beta.splunkresearch.com/icons/next.svg')}html{--color-mode: "light";--light: #fff;--dark:  rgb(28,28,30);--haze: #f2f5f7;--bubble: rgb(36,36,38);--accent: var(--haze);--bg: var(--light);--code-bg: var(--accent);--overlay: var(--light);--text: #141010;--font: 'Splunk Data Sans Pro', Arial;--border-color: #eee;--inline-color: darkgoldenrod;--theme: rgb(52,199,89);--ease: ease;--scroll-thumb: rgba(0,0,0,.8);--search-border-color: transparent;--next-icon-path: url(../images/icons/double-arrow.svg);--never-icon-path: url(../images/sitting.svg)}html[data-mode="dark"]{--color-mode: "dark";--theme: rgb(48,209,88);--bg: var(--dark);--text: #eee;--text-light: #fff;--accent: var(--bubble);--overlay: var(--bubble);--border-color: transparent;--scroll-thumb: rgba(255,255,255,.6);--search-bg: var(--accent);--search-border-color: var(--accent)}html[data-mode="dark"] *{box-shadow:none !important}html[data-mode="dark"] .color_choice::after{background-image:var(--moon-icon)}@media (prefers-color-scheme: dark){html[data-mode="auto"]{--color-mode: "dark";--theme: rgb(48,209,88);--bg: var(--dark);--text: #eee;--text-light: #fff;--accent: var(--bubble);--overlay: var(--bubble);--border-color: transparent;--scroll-thumb: rgba(255,255,255,.6);--search-bg: var(--accent);--search-border-color: var(--accent)}html[data-mode="auto"] *{box-shadow:none !important}}blockquote+.highlight_wrap{margin-top:2.25rem}*{box-sizing:border-box;margin:0;padding:0;scrollbar-color:var(--scroll-thumb) transparent;scrollbar-width:auto}::-webkit-scrollbar{width:1rem}::-webkit-scrollbar-thumb{background:var(--scroll-thumb);border-radius:.25rem}body,html{scroll-behavior:smooth;scroll-padding-top:1rem;font-kerning:normal;-webkit-text-size-adjust:100%;font-size:18px}@keyframes flash{0%{opacity:0}75%{opacity:0}100%{opacity:1}}body{font-family:var(--font);background-color:var(--bg);color:var(--text);line-height:1.5;margin:0;position:relative;display:flex;min-width:0;flex-direction:column;justify-content:space-between;min-height:100vh;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-overflow-scrolling:touch;max-width:100%;animation:0.67s flash ease-in;padding:0;overflow-x:hidden}@media screen and (min-width: 1640px){body{max-width:1600px;margin:0 auto}}@media (max-width: 768px){body{font-size:16px}}a{text-decoration:none;color:inherit}p{padding:0.75rem 0}p:empty{display:none}li,li p{padding:0.25rem 0}blockquote{opacity:0.8;padding:1rem;position:relative;quotes:"“" "”" "‘" "’";margin:0.75rem 0;display:flex;flex-flow:row wrap;background-repeat:no-repeat;background-size:5rem;background-position:50% 50%;position:relative;background-color:var(--accent);border-radius:0.25rem;overflow:hidden}blockquote::before{content:"";padding:2px;position:absolute;top:0;bottom:0;left:0;background:var(--theme)}blockquote p{padding-left:0.5rem !important;font-size:1.1rem !important;width:100%;font-style:italic}h1,h2,h3,h4,h5{font-family:inherit;font-weight:500;padding:0.33rem 0;color:inherit;line-height:1.35}h1{font-size:200%}h2{font-size:175%}h3{font-size:150%}h4{font-size:125%}h5{font-size:120%}h6{font-size:100%}img,svg,figure{max-width:100%;vertical-align:middle}img{height:auto;margin:1rem auto;padding:0}.main,main{flex:1}.main>.grid-auto,main>.grid-auto{display:grid;grid-template-columns:1fr;gap:1rem}@media screen and (min-width: 769px){.main>.grid-auto,main>.grid-auto{grid-template-columns:180px 1fr}}@media screen and (max-width: 768px){.main>.grid-auto,main>.grid-auto{grid-gap:0}}ol,ul{list-style:none}b,strong{font-weight:500}hr{border:none;height:1px;background-color:var(--border-color);margin:1rem 0}@media (prefers-color-scheme: dark){hr{background-color:rgba(255,255,255,0.2)}}.aside{overflow-y:auto;background:var(--bg);border-radius:0.25rem;align-self:start;max-height:80vh;position:sticky;z-index:9999;top:0;padding:1rem 0}@media screen and (min-width: 42rem){.aside{padding:1rem 1.5rem;top:2.5rem;margin-top:1rem;padding-top:0}}@media (max-width: 768px){.aside{width:100%;position:static;height:auto}}.aside_inner{height:0;overflow:hidden}@media screen and (min-width: 42rem){.aside_inner{height:initial}}.aside.show .aside_inner{height:initial;overflow:visible}.aside_toggle{padding:0.5rem 1.5rem;border-radius:0.5rem;background:var(--accent);transform:translateY(-1rem);display:flex;justify-content:space-between}@media screen and (min-width: 42rem){.aside_toggle{display:none}}.aside h3{position:relative}.aside ul{padding:0;list-style:none}th,td{padding:0.5rem;font-weight:400 !important}th:not(:first-child),td:not(:first-child){padding-left:1.5rem}thead{background:var(--theme);color:var(--light);font-weight:400;text-align:left}tbody tr:nth-child(even){background-color:var(--accent) !important;box-shadow:0 1rem 0.75rem -0.75rem rgba(0,0,0,0.07)}table{margin:1.5rem 0;width:100%}.page-home h1{font-weight:300}.content{flex:1;padding:2rem 1rem 1rem 1rem;width:100%;max-width:none}@media (max-width: 768px){.content{width:100%;padding:1.5rem 0.5rem 1rem 0.5rem}}.page-home .content{padding-top:0}@media (max-width: 768px){.page-home .content{padding-top:0}}.content ul,.content ol{padding-left:1.1rem}.content ul{list-style:initial}.content ol{list-style:decimal}.content a:not(.button){color:var(--theme)}::placeholder{font-size:1rem}svg.icon_sort{fill:var(--light);height:0.7rem;width:0.7rem;display:inline-block;margin-left:auto;vertical-align:middle}canvas{margin:2.5rem auto 0 auto;max-width:450px !important;max-height:450px !important}footer{min-height:150px}del{opacity:0.5}#toTop{background:transparent;outline:0.5rem solid transparent;height:2rem;width:2rem;cursor:pointer;padding:0.5rem;display:flex;align-items:center;justify-content:center;position:fixed;right:0;bottom:2.25rem;transform:rotate(45deg) translate(5rem);opacity:0;transition:opacity 0.5s var(--ease),transform 0.25s var(--ease);z-index:5}#toTop.active{right:1.5rem;opacity:1;transform:rotate(45deg) translate(0)}#toTop::after,#toTop::before{position:absolute;display:block;width:1rem;height:1rem;content:"";border-left:1px solid var(--text);border-top:1px solid var(--text)}#toTop::after{width:0.67rem;height:0.67rem;transform:translate(0.1rem, 0.1rem)}@media (max-width: 768px){#toTop{right:1rem;bottom:1rem}}#searchpage{padding-top:10rem}.framework-box{border:1px solid #ddd;padding:10px;margin-bottom:20px;border-radius:5px}.pill{display:inline-block;padding:5px 10px;margin:2px;border-radius:20px;background-color:#f0f0f0;font-size:14px;cursor:default;user-select:none;opacity:0.9}.kill-chain{display:flex;justify-content:space-between}.collapsible{max-height:0;overflow:hidden;transition:max-height 0.3s ease-out}.expanded{max-height:500px}.nav{display:grid;grid-gap:1rem;padding:0 1rem !important;align-items:center;background-color:var(--bg)}@media screen and (min-width: 992px){.nav{grid-template-columns:8rem 1fr;padding:0 1.25rem !important}}@media screen and (min-width: 1200px){.nav{grid-template-columns:10rem 1fr;padding:0 1.5rem !important}}.nav_brand{position:relative}.nav_brand picture,.nav_brand img{max-width:8rem}@media screen and (min-width: 1200px){.nav_brand picture,.nav_brand img{max-width:10rem}}.nav_header{position:absolute;top:0;left:0;width:100%;background-color:var(--bg);z-index:999999}.nav_toggle{position:absolute;top:0;bottom:0;width:3rem;display:flex;align-items:center;justify-content:flex-end;text-align:center;right:0;color:var(--text)}@media screen and (min-width: 992px){.nav_toggle{display:none}}.nav_body{display:flex;flex-direction:column;background:var(--accent);position:fixed;left:0;top:0;bottom:0;height:100vh;transition:transform 0.25s var(--ease);transform:translateX(-101vw)}@media screen and (min-width: 992px){.nav_body{transform:translateX(0);position:relative;height:initial;justify-content:flex-end;background:transparent;flex-direction:row;gap:0.1rem;flex-wrap:nowrap}}.nav.show .nav_body{transform:translateX(0);box-shadow:0 1rem 4rem rgba(0,0,0,0.1);background:var(--bg);overflow-y:auto}.nav.show .nav_body li:first-child{margin:1.5rem 1rem 0.5rem 1rem}.nav-link{display:inline-flex;padding:0.5rem 0.5rem;position:relative;border-radius:0.375rem;transition:all 0.3s cubic-bezier(0.4, 0, 0.2, 1);font-size:0.85rem}@media screen and (min-width: 1200px){.nav-link{padding:0.5rem 0.7rem;font-size:0.9rem}}@media screen and (min-width: 1400px){.nav-link{padding:0.5rem 0.9rem;font-size:0.95rem}}.nav-link:not(.nav_repo a):not(.search *):hover{background-color:var(--accent);transform:translateY(-2px);box-shadow:0 4px 12px rgba(0,0,0,0.15)}.nav-link:not(.nav_repo a):not(.search *):hover span{color:var(--theme);font-weight:500}.nav-link:not(.nav_repo a):not(.search *)::after{content:'';position:absolute;bottom:0;left:50%;width:0;height:2px;background-color:var(--theme);transition:all 0.3s cubic-bezier(0.4, 0, 0.2, 1);transform:translateX(-50%)}.nav-link:not(.nav_repo a):not(.search *):hover::after{width:80%}.nav-item{display:grid;align-items:center;flex-shrink:0}@media screen and (min-width: 992px){.nav-item .search{margin-right:0.75rem}}@media screen and (min-width: 1200px){.nav-item .search{margin-right:1rem}}@media screen and (min-width: 1400px){.nav-item .search{margin-right:1.25rem}}.nav_repo{display:none !important}.nav-item{display:inline-flex;margin-right:0px;flex-shrink:0}.nav-item:last-child{margin-right:0}.nav-link{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.nav-item:last-child,.nav-item.nav_repo{display:none !important}.fixed-controls{position:fixed;top:0.75rem;right:0.75rem;z-index:1000;display:flex;align-items:center;gap:0.4rem;background:var(--accent);backdrop-filter:blur(10px);border-radius:1rem;padding:0.3rem 0.5rem;border:1px solid var(--border-color);box-shadow:0 1rem 2rem rgba(0,0,0,0.17);font-size:0.875rem}@media (max-width: 768px){.fixed-controls{top:0.5rem;right:0.5rem;padding:0.25rem 0.4rem;gap:0.3rem}}.fixed-controls .github-link{display:flex;align-items:center;opacity:0.8;transition:opacity 0.2s ease;line-height:1}.fixed-controls .github-link:hover{opacity:1}.fixed-controls .github-link picture,.fixed-controls .github-link img{width:1rem !important;height:1rem !important;max-width:1rem !important;max-height:1rem !important;margin:0 !important;padding:0 !important;filter:var(--icon-filter)}.fixed-controls .theme-switcher{display:flex;align-items:center}.aside.menu{background-color:var(--accent);border-right:1px solid var(--border-color);padding:1rem}.aside.menu .section_title{margin-bottom:1rem}.section_title{font-size:1.25rem;font-weight:400;color:var(--theme);border-bottom:2px solid var(--theme);padding-bottom:0.5rem;margin-bottom:0.5rem}.section_link{font-size:1rem;font-weight:400}.sidebar-link,.sidenav-link{display:grid;padding:0.2rem 0}.section_link{font-size:1rem;font-weight:400;transition:all 0.3s ease}.section_link a{display:block;padding:0.25rem 0.5rem;white-space:normal;overflow:visible;word-wrap:break-word}.section_link:hover,.section_link.active{background-color:var(--accent)}.section_link:hover a,.section_link.active a{color:var(--theme)}.section_link:hover:not(.active){background-color:var(--accent);color:var(--theme);border-radius:0.25rem;padding:0.25rem 0.5rem}.filter-container{display:flex;align-items:center;margin-bottom:1rem}.form_search{flex-grow:1;margin-right:0.5rem}.filter-count{display:inline-block;padding:0.2em 0.6em;border-radius:1em;font-size:0.9em;font-weight:600;background-color:rgba(var(--theme-rgb), 0.1);color:var(--theme)}.toc{padding:0;margin:1rem 0;height:auto;overflow:visible;display:block}.toc ul{list-style-type:none;padding-left:0.5rem}.toc li{font-size:0.85rem;padding:0.1rem 0;margin-bottom:0.3rem}.toc a{color:var(--text);text-decoration:none;display:block;padding:0.2rem 0.4rem;border-left:2px solid transparent;transition:all 0.3s ease}.toc a:hover{color:var(--theme);background-color:var(--accent);border-left-color:var(--theme)}.toc>ul>li>a{font-weight:600;font-size:0.9rem;margin-top:0.8rem;margin-bottom:0.4rem;border-bottom:1px solid var(--accent)}.search{flex:1;display:flex;justify-content:flex-end;position:relative}.search_field{padding:0.5rem 1.5rem 0.5rem 2.5rem;border-radius:1.5rem;width:13.5rem;outline:none;border:1px solid var(--search-border-color);background:transparent;color:var(--text);box-shadow:0 1rem 4rem rgba(0,0,0,0.17);font-size:1rem}.search_field:hover,.search_field:focus{background:var(--search-bg)}.search_label{width:1rem;height:1rem;position:absolute;left:0.33rem;top:0.25rem;opacity:0.33}.search_label svg{width:100%;height:100%;fill:var(--text)}.search_result{padding:0.5rem 1rem;display:block}.search_result:not(.passive):hover{background-color:var(--theme);color:var(--light)}.search_result.passive{display:grid}.search_results{width:13.5rem;background-color:var(--overlay);border-radius:0 0 0.25rem 0.25rem;box-shadow:0 1rem 4rem rgba(0,0,0,0.17);position:absolute;top:125%;display:grid;overflow:hidden;z-index:5}.search_results:empty{display:none}.search_title{padding:0.5rem 1rem 0.5rem 1rem;background:var(--theme);color:var(--light);font-size:0.9rem;opacity:0.87;text-transform:uppercase}.button{background-color:var(--theme);color:var(--light);border-radius:0.25rem;display:inline-block;padding:0.75rem 1.25rem;text-align:center}.button:hover{opacity:0.84}.button+.button{background-color:var(--haze);color:var(--dark)}.button_grid{display:grid;max-width:15rem;grid-gap:1rem;grid-template-columns:repeat(auto-fit, minmax(12rem, 1fr))}@media screen and (min-width: 557px){.button_grid{max-width:25rem}}.button.center{display:block;margin-left:auto;margin-right:auto;text-align:center}.button.red{background-color:red;color:white}.button.blue{background-color:blue;color:white}.button.green{background-color:green;color:white}.button.purple{background-color:purple;color:white}.video{overflow:hidden;padding-bottom:56.25%;position:relative;height:0;margin:1.5rem 0;border-radius:0.6rem;background-color:var(--bg);box-shadow:0 1rem 2rem rgba(0,0,0,0.17)}.video iframe{left:0;top:0;height:100%;width:100%;border:none;position:absolute;transform:scale(1.02)}.icon{width:1.1rem;height:1.1rem;display:inline-flex;justify-content:center;align-items:center;margin:0 0.5rem}.link{opacity:0;position:relative}.link_owner:hover .link{opacity:1}.link_yank{opacity:1}.link_yanked{position:absolute;right:-2.2rem;top:-2rem;background-color:var(--theme);color:var(--light);width:7rem;padding:0.25rem 0.5rem;font-size:0.9rem;border-radius:1rem;text-align:center}.link_yanked::after{position:absolute;top:1rem;content:"";border-color:var(--theme) transparent;border-style:solid;border-width:1rem 1rem 0 1rem;height:0;width:0;transform-origin:50% 50%;transform:rotate(145deg);right:0.45rem}.gallery{width:100%;column-count:3;column-gap:1rem}@media screen and (max-width: 667px){.gallery{column-count:2}}.gallery_item{background-color:transparent;margin:0 0 1rem}.gallery_image{margin:0 auto}.pager{display:flex;justify-content:space-between;align-items:center;padding-top:2rem;margin:2rem 0;max-width:100vw;overflow:hidden}.pager svg{filter:opacity(0.75);width:1.25rem;height:1rem;transform-origin:50% 50%}.pager_lean{justify-content:flex-end}.pager_label{max-width:100%;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.pager_link{padding:0.5rem 1rem;border-radius:0.25rem;width:12.5rem;max-width:40vw;position:relative;display:flex;align-items:center;text-align:center;justify-content:center}.pager_link::before,.pager_link::after{background-image:var(--next-icon);height:0.8rem;width:0.8rem;background-size:100%;background-repeat:no-repeat;transform-origin:50% 50%}.pager_item{display:flex;flex-direction:column;flex:1;max-width:48%}.pager_item.prev{align-items:flex-start}.pager_item.next{align-items:flex-end}.pager_item.next::after{content:""}.pager_item.prev .pager_link::before{content:"";transform:rotate(180deg);margin-right:0.67rem}.pager_item.next .pager_link::after{content:"";margin-left:0.67rem}.pager_item.next .pager_link{grid-template-columns:1fr 1.5rem}.pager_meta{margin:0.5rem 0}.color_mode{margin-left:1rem}.color_choice{outline:none;border:none;-webkit-appearance:none;height:1rem;position:relative;width:1rem;border-radius:1rem;cursor:pointer;z-index:2;right:0;filter:contrast(0.8)}.color_choice::after{content:"";top:0.1rem;bottom:0;left:0;position:absolute;height:1.3rem;background:var(--accent);width:1.3rem;border-radius:0.4rem;z-index:3;background-image:var(--sun-icon);background-size:60%;background-position:center;background-repeat:no-repeat}.color_icon{height:1rem;width:1rem;margin:0;z-index:4;position:absolute;transform:translateY(-50%);transition:transform 0.5s cubic-bezier(0.19, 1, 0.22, 1);right:3.5rem}.tip{padding:1.5rem 1rem 1.5rem 1.5rem;margin:1.5rem 0;border-left:0.2rem solid var(--theme);position:relative;background:var(--accent)}.tip blockquote{padding:0;margin:0;border:none}.tip blockquote::before{display:none}.tip p:first-child,.tip p~p{padding-top:0}.tip p:last-child{padding-bottom:0}.tip_warning{--theme: var(--inline-color)}.tip_warning::before{transform:rotate(180deg)}.tip::before{content:"";position:absolute;left:-0.85rem;top:1.5rem;z-index:3;padding:0.75rem;transform-origin:50% 50%;border-radius:50%;background-color:var(--theme);background-image:var(--info-icon);background-size:12%;background-position:50% 50%;background-repeat:no-repeat}.tabs{display:flex;flex-wrap:wrap;margin:2rem 0 2rem 0;position:relative}.tabs.tabs-left{justify-content:flex-start}.tabs.tabs-left label.tab-label{margin-right:0.5rem}.tabs.tabs-left .tab-content{border-radius:0px 6px 6px 6px}.tabs.tabs-right{justify-content:flex-end}.tabs.tabs-right label.tab-label{margin-left:0.5rem}.tabs.tabs-right .tab-content{border-radius:6px 6px 6px 6px}.tabs input.tab-input{display:none}.tabs label.tab-label{background-color:var(--accent) transparent;border-color:var(--theme);border-radius:6px 6px 0px 0px;border-style:solid;border-bottom-style:hidden;border-width:2px;cursor:pointer;display:inline-block;order:1;padding:0.3rem 0.6rem;position:relative;top:2px;user-select:none}.tabs input.tab-input:checked+label.tab-label{background-color:var(--accent);border-color:var(--theme)}.tabs .tab-content{background-color:var(--accent);border-color:var(--theme);border-style:solid;border-width:2px;display:none;order:2;padding:1rem;width:100%}.button-center{display:block;margin:0 auto;text-align:center}.center{display:flex;flex-direction:column;align-items:center;justify-content:center;margin-left:auto;margin-right:auto;text-align:center;text-align:center}.small-image{width:50%}.hero{position:relative;width:100%;height:400px;color:white;text-align:center;overflow:hidden;margin-top:-2rem}@media (max-width: 768px){.hero{height:300px;margin-top:-1rem}}.hero-video{position:absolute;top:50%;left:50%;min-width:100%;min-height:100%;width:auto;height:auto;transform:translateX(-50%) translateY(-50%);object-fit:cover}.hero-text{position:absolute;top:50%;left:50%;transform:translate(-50%, -50%);z-index:2;width:100%;padding:1rem;align-items:center}.hero-text h1{font-size:2.5rem;margin-bottom:1rem;white-space:normal;word-wrap:break-word}@media (max-width: 768px){.hero-text h1{font-size:1.8rem}}.hero-text .hero-description{font-size:1rem;margin-bottom:1rem;max-width:80%;margin-left:auto;margin-right:auto}@media (max-width: 768px){.hero-text .hero-description{font-size:0.9rem;max-width:90%}}.hero-text .transparent-button{font-size:1rem;padding:0.5rem 1rem;background-color:var(--theme);color:rgba(255,255,255,0.9);border:2px solid var(--theme);transition:background-color 0.3s, color 0.3s}.hero-text .transparent-button:hover{background-color:#1f7635;color:white}@media (max-width: 768px){.hero-text .transparent-button{font-size:0.9rem;padding:0.4rem 0.8rem}}.pill{display:inline-block;padding:0.1em 0.4em;border-radius:0.75em;font-size:0.8em;font-weight:600;text-transform:uppercase;letter-spacing:0.05em}.pill.ttp{background-color:rgba(142,142,147,0.2);color:#8e8e93}.pill.TTP{background-color:rgba(255,69,58,0.2);color:#ff453a}.pill.Anomaly{background-color:rgba(255,159,10,0.2);color:#ff9f0a}.pill.Correlation{background-color:rgba(48,209,88,0.2);color:#30d158}.pill.Hunting{background-color:rgba(191,90,242,0.2);color:#bf5af2}.icon-tiny{width:20px;height:20px;display:inline-block;vertical-align:middle;margin-right:3px;flex-shrink:0;margin:0;padding:0}img.icon-tiny{width:20px;height:20px;display:inline-block;vertical-align:middle;margin:0 3px 0 0;padding:0;flex-shrink:0}.table-wrapper{overflow-x:auto;max-width:100%;-webkit-overflow-scrolling:touch}@media screen and (max-width: 768px){.table-wrapper .detection-table,.table-wrapper .stories-table,.table-wrapper .playbooks-table,.table-wrapper .data-sources-table{min-width:800px}}.detection-table,.stories-table,.playbooks-table,.data-sources-table{width:100%;table-layout:fixed}.detection-table th,.detection-table td,.stories-table th,.stories-table td,.playbooks-table th,.playbooks-table td,.data-sources-table th,.data-sources-table td{word-wrap:break-word;overflow-wrap:break-word;padding:0.5rem}@media screen and (max-width: 768px){.detection-table,.stories-table,.playbooks-table,.data-sources-table{font-size:14px}.detection-table th,.detection-table td,.stories-table th,.stories-table td,.playbooks-table th,.playbooks-table td,.data-sources-table th,.data-sources-table td{padding:0.3rem}}.detection-table .col-0{width:25%}.detection-table .col-1{width:15%}.detection-table .col-2{width:15%}.detection-table .col-3{width:14%}.detection-table .col-4{width:18%}.detection-table .col-5{width:14%}.detection-table .col-6{width:13%}.stories-table .col-0{width:25%}.stories-table .col-1{width:20%}.stories-table .col-2{width:15%}.stories-table .col-3{width:20%}.stories-table .col-4{width:0%}.stories-table .col-5{width:13%}.data-sources-table .col-0{width:28%}.data-sources-table .col-1{width:14%}.data-sources-table .col-2{width:22%}.data-sources-table .col-3{width:20%}.data-sources-table .col-4{width:22%}.metadata-container{display:flex;flex-wrap:wrap;gap:10px;margin-bottom:20px}.metadata-square{display:inline-flex;align-items:center;padding:5px 10px;font-size:14px;background-color:var(--accent);color:var(--text);border:1px solid var(--border-color)}.metadata-square.date{background-color:#4CAF50;color:white}.metadata-square.id{background-color:#2196F3;color:white}.metadata-square.author{background-color:#9C27B0;color:white}.metadata-square.type{color:white !important}.metadata-square.type a{color:white !important}.metadata-square.type.TTP{background-color:#ff453a}.metadata-square.type.Anomaly{background-color:#ff9f0a}.metadata-square.type.Correlation{background-color:#30d158}.metadata-square.type.Hunting{background-color:#bf5af2}.metadata-square.type.Baseline{background-color:#007aff}.metadata-square.type.Investigation{background-color:#bf5af2}.metadata-square.type.Response{background-color:#30d158}.metadata-square.product{color:white;text-decoration:none;cursor:pointer;transition:background-color 0.3s ease}.metadata-square.product:hover{background-color:#e6e6e6;text-decoration:underline}.detection-framework{border:1px solid var(--border-color);padding:15px;margin-bottom:20px;display:flex;flex-wrap:wrap;gap:10px}.detection-framework .square{display:inline-flex;align-items:center;padding:5px 10px;font-size:14px;background-color:var(--accent);color:var(--text);border:1px solid var(--border-color)}.detection-framework .square.mitre-technique{background-color:rgba(0,102,204,0.2);color:#06c}.detection-framework .square.mitre-tactic{background-color:rgba(255,102,0,0.2);color:#f60}.detection-framework .square.kill-chain{background-color:rgba(76,175,80,0.2);color:#4caf50}.detection-framework .square.nist{background-color:rgba(156,39,176,0.2);color:#9c27b0}.detection-framework .square.cis{background-color:rgba(255,152,0,0.2);color:#ff9800}.detection-framework .square.threat-actor{background-color:rgba(244,67,54,0.2);color:#f44336}.detection-framework .square img{height:16px;margin-right:5px}.detection-framework .square a{color:inherit;text-decoration:none}.mitre-table{width:100%;border-collapse:collapse;margin-bottom:1em}.mitre-table th,.mitre-table td{border:1px solid var(--border-color);padding:8px;text-align:left}.mitre-table th{background-color:var(--theme);color:var(--light);font-weight:bold}.mitre-table tr:nth-child(even){background-color:var(--accent)}.mitre-table tr:nth-child(odd){background-color:var(--bg)}.mitre-table td{color:var(--text)}.mitre-table a{color:var(--theme);text-decoration:none}.mitre-table a:hover{text-decoration:underline}.framework-box{border:1px solid var(--border-color);padding:15px;margin-bottom:20px;background-color:var(--bg)}.framework-headers{display:flex;flex-wrap:wrap;gap:10px;margin-bottom:15px}.section-header{cursor:pointer;padding:5px 10px;border-radius:0.75em;font-size:14px;background-color:var(--accent);color:var(--text)}.section-header.active{background-color:var(--theme);color:var(--light)}.expand-icon{display:inline-block;width:20px;text-align:center;font-weight:bold}.framework-section{display:none;margin-bottom:10px}.framework-section.active{display:block}.section-content{display:flex;flex-wrap:wrap;gap:5px}.pill{display:inline-block;padding:0.1em 0.4em;border-radius:0.75em;font-size:0.8em;font-weight:600;text-transform:uppercase;letter-spacing:0.05em}.pill.mitre-technique{background-color:rgba(0,102,204,0.2);color:#06c}.pill.mitre-tactic{background-color:rgba(255,102,0,0.2);color:#f60}.pill.kill-chain{background-color:rgba(76,175,80,0.2);color:#4caf50}.pill.nist{background-color:rgba(156,39,176,0.2);color:#9c27b0}.pill.cis{background-color:rgba(255,152,0,0.2);color:#ff9800}.pill.threat-actor{background-color:rgba(255,0,0,0.1);color:#f44336;cursor:pointer}.mitre-coverage-table{display:grid;grid-template-columns:repeat(auto-fill, minmax(200px, 1fr));gap:1rem;margin-top:2rem}.technique-item{border:1px solid var(--border-color);border-radius:0.25rem;padding:1rem;background-color:var(--bg)}.technique-item h3{font-size:1rem;margin-bottom:0.5rem;color:var(--text)}.ttp-button{display:block;width:100%;padding:0.5rem;background-color:var(--accent);border:1px solid var(--border-color);border-radius:0.25rem;cursor:pointer;position:relative;font-size:0.9rem;color:var(--text)}.coverage-dot{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:10px;height:10px;border-radius:50%}.coverage-dot.red{background-color:#ff0000}.coverage-dot.yellow{background-color:#ffff00}.coverage-dot.green{background-color:#00ff00}@media screen and (max-width: 768px){.filter-container{display:flex;flex-direction:column;align-items:flex-start}.filter-container input{width:100%;margin-bottom:0.5rem}.filter-container .filter-count{align-self:flex-end}}@media screen and (max-width: 768px){.pill{font-size:12px;padding:2px 5px}}@media screen and (max-width: 768px){.sortable{padding-right:1.5rem;position:relative}.sortable .icon{position:absolute;right:0.3rem;top:50%;transform:translateY(-50%)}}@media screen and (max-width: 768px){td .pill{display:inline-block;margin-bottom:2px}}html[data-mode="dark"] .mermaid{--theme: darkgoldenrod;background-color:transparent !important;margin-bottom:2.5rem}html[data-mode="dark"] .mermaid svg{margin:0 auto;display:block}.post{margin:0 auto;width:100%}.post p,.post h1,.post h2,.post h3,.post h4,.post h5,.post h6,.post blockquote,.post ol,.post ul,.post .highlight_wrap,.post hr{max-width:840px !important;margin-left:auto;margin-right:auto}@media screen and (min-width: 1025px){.post img:not(.icon){display:block;width:100vw;max-width:1024px;margin-left:auto;margin-right:auto}}.post h2,.post h3,.post h4{margin:0.5rem auto;text-align:left;padding:5px 0 0 0}.post p{padding-bottom:0.5rem;padding-top:0.5rem;font-size:1.05rem}.posts{display:flex;justify-content:space-between;flex-flow:row wrap;width:100%;align-items:stretch}.posts:not(.aside){padding:0 30px}.post ol{padding:1rem 1.25rem}.post_body img{width:100%;max-width:100%}.post_inner a{color:var(--theme);transition:all 0.3s}.post_inner a:hover{opacity:0.8;text-decoration:underline}.post_inner img:not(.icon){margin-bottom:2rem;box-shadow:0 1.5rem 1rem -1rem rgba(0,0,0,0.25)}.post_inner img:not(.icon)~h1,.post_inner img:not(.icon)~h2,.post_inner img:not(.icon)~h3,.post_inner img:not(.icon)~h4{margin-top:0;padding-top:0}.post .icon{margin-top:0;margin-bottom:0}.post_date{color:var(--theme)}.post_copy{opacity:0;transition:opacity 0.3s ease-out}.post_item{box-shadow:0 0 3rem rgba(0,0,0,0.17);margin:1.25rem 0;border-radius:10px;overflow:hidden;width:100%}.post_item:hover{box-shadow:0 0 5rem rgba(0,0,0,0.255)}@media screen and (min-width: 667px){.post_item{width:47%}}.post_item:hover .post_copy{opacity:1}.post_link{padding:2.5px 0;font-size:1.25em;margin:2.5px 0;text-align:left}.post_meta{overflow:hidden;opacity:0.8;font-size:0.84rem;font-weight:500;display:inline-grid;grid-template-columns:auto 1fr;background-color:var(--light);padding:0;align-items:center;border-radius:0.3rem;color:var(--dark);text-transform:capitalize}.post_meta a:hover{color:var(--theme);text-decoration:underline;opacity:0.9}.post_extra{display:flex;justify-content:flex-end}.post_tag{font-size:0.75rem !important;font-weight:500;background:var(--theme);color:var(--light);padding:0.25rem 0.67rem !important;text-transform:uppercase;display:inline-flex;border-radius:5px}.post_title{margin:1.75rem 0 1rem}.post_time{background:var(--theme);display:inline-grid;padding:0.2rem 0.75rem;color:var(--light)}.post_thumbnail{width:100%;margin:0}.post_nav{padding:3rem 1.5rem;display:grid;margin:2.25rem auto 1rem;text-align:center;color:var(--theme);text-transform:uppercase}.post_nav,.post_nav span{position:relative;z-index:3}.post_nav::before{content:"";position:absolute;background:var(--accent);top:0;left:0;bottom:0;right:0;z-index:1;border-radius:1rem}.post_next{display:inline-grid;margin:0 auto;width:10rem;grid-template-columns:1fr 1.33rem}.post_next::after{content:"";background-image:var(--next-icon-path);background-repeat:repeat no-repeat;background-size:0.8rem;background-position:center right}.excerpt{padding:0 10px 1.5rem 10px;position:relative;z-index:1}.excerpt_meta{display:flex;justify-content:space-between;align-items:center;transform:translateY(-2.5rem);position:relative;z-index:5}.archive_item{display:grid;padding:1.5rem 0}.archive_title{margin:0}.article{box-shadow:0 0.5rem 2rem rgba(0,0,0,0.12);overflow:hidden;border-radius:0.5rem}.article_title{margin:0}.article_excerpt{transition:height 0.5s, opacity 0.5s}.article_excerpt:not(.visible){height:0;opacity:0}.article_excerpt,.article_meta{transform-origin:bottom}.article_meta{padding:10px 1.25rem 1.25rem;color:var(--text);position:relative;z-index:2;transition:margin-top 0.5s;background:var(--bg)}.article_meta.center_y{transform-origin:center;transition:transform 0.5s;display:flex;flex-direction:column;justify-content:center}@media screen and (min-width: 42rem){.article_meta.center_y{left:-2rem}}.article_thumb{display:grid;position:relative;z-index:0;overflow:hidden;height:15rem;background-size:cover;background-position:50% 50%}@media screen and (min-width: 35rem){.article_thumb{height:22.5rem}}.article_thumb img{transition:transform 0.5s, opacity 0.5s}.article_thumb::after{content:'';position:absolute;top:0;left:0;width:100%;bottom:0;z-index:1;background:var(--bg);opacity:0;transition:opacity 0.1s ease-out}.article_showcase .article_thumb{height:15rem}.article_showcase .article_meta{padding-top:1.5rem}.article:hover .article_thumb img{transform:scale(1.1)}.article:hover .article_thumb::after{transition:opacity 0.1s ease-out;opacity:0.5}.article:hover .article_excerpt:not(.visible){height:75px;opacity:1}.article:hover .article_meta:not(.center_y){margin-top:-75px}@media screen and (min-width: 769px){.article:hover .article_meta.center_y{transform:translateX(-3rem)}}.article:hover{box-shadow:0 1.5rem 6rem rgba(0,0,0,0.17)}.article:hover a{color:initial !important}.article_hidden{display:none}.wrap{max-width:1240px}@media screen and (min-width: 1640px){.wrap{max-width:1600px}}.wrap,.wrap{width:100%;padding:0 25px;margin:0 auto}.pt-1{padding-top:1.5rem}.pb-1{padding-bottom:1.5rem}.mt-1{margin-top:1.5rem}.mb-1{margin-bottom:1.5rem}.pt-2{padding-top:3rem}.pb-2{padding-bottom:3rem}.mt-2{margin-top:3rem}.mb-2{margin-bottom:3rem}.pt-3{padding-top:4.5rem}.pb-3{padding-bottom:4.5rem}.mt-3{margin-top:4.5rem}.mb-3{margin-bottom:4.5rem}.pt-4{padding-top:6rem}.pb-4{padding-bottom:6rem}.mt-4{margin-top:6rem}.mb-4{margin-bottom:6rem}.pt-5{padding-top:7.5rem}.pb-5{padding-bottom:7.5rem}.mt-5{margin-top:7.5rem}.mb-5{margin-bottom:7.5rem}.pt-6{padding-top:9rem}.pb-6{padding-bottom:9rem}.mt-6{margin-top:9rem}.mb-6{margin-bottom:9rem}.pt-7{padding-top:10.5rem}.pb-7{padding-bottom:10.5rem}.mt-7{margin-top:10.5rem}.mb-7{margin-bottom:10.5rem}.pt-8{padding-top:12rem}.pb-8{padding-bottom:12rem}.mt-8{margin-top:12rem}.mb-8{margin-bottom:12rem}.grid-2,.grid-3,.grid-4,.grid-auto,.grid-reverse{display:grid;grid-template-columns:1fr}[class*='grid-']{grid-gap:2rem}@media screen and (min-width: 42rem){.grid-auto{grid-template-columns:2fr 5fr}.grid-reverse{grid-template-columns:3fr 1fr}.grid-2{grid-template-columns:repeat(2, 1fr)}.grid-3{grid-template-columns:repeat(auto-fit, minmax(15rem, 1fr))}.grid-4{grid-template-columns:repeat(auto-fit, minmax(12rem, 1fr))}}.active{color:var(--theme)}.is{background:var(--theme);color:var(--light)}.toggle svg{fill:var(--text);display:inline-block;transform-origin:50% 50%;transform:scale(1.2);cursor:pointer;margin:0}.scrollable{width:100%;overflow-x:hidden;max-width:calc(100vw - 48px)}@media screen and (min-width: 768px){.scrollable{max-width:100%}}.scrollable:hover{overflow-x:auto}.chart{display:grid;grid-gap:1.5rem;min-width:0;max-width:98vw !important;max-height:98vw !important}.link{display:inline-flex;align-items:center;width:2.5rem;margin:0 0.25rem;padding:0 0.25rem;opacity:0;transition:opacity 0.3s cubic-bezier(0.39, 0.575, 0.565, 1)}.link svg,.link img{width:1.5rem;height:1.5rem;fill:var(--theme)}.link_owner:hover .link{opacity:0.9}.copy{cursor:pointer}.standardize-input{appearance:none;-webkit-appearance:none}@keyframes pulse{0%{opacity:1}75%{opacity:0.1}100%{opacity:1}}code{font-size:15px;font-weight:400;overflow-y:hidden;display:block;font-family:'Monaco', monospace;word-break:break-all}code.noClass{color:var(--inline-color);display:inline;line-break:anywhere}.windows .highlight{overflow-x:hidden}.windows .highlight:hover{overflow-x:auto}.highlight{display:grid;width:100%;border-radius:0 0.2rem 0.2rem 0;overflow-x:auto;position:relative;white-space:pre-wrap;word-wrap:break-word}.highlight_wrap{display:grid;background:var(--code-bg) !important;border-radius:0.5rem;position:relative;padding:0 1rem;margin:1.5rem auto 1rem auto}.highlight_wrap .highlight_wrap{margin:0;padding:0}.highlight_wrap+.highlight_wrap{margin-top:2.25rem}.highlight_wrap:hover>div{opacity:1}.highlight_wrap .lang{position:absolute;top:0;right:0;text-align:right;width:7.5rem;padding:0.5rem 1rem;font-style:italic;text-transform:uppercase;font-size:67%;opacity:0.5;color:var(--text)}.highlight_wrap:hover .lang{opacity:0.1}.highlight .highlight{margin:0}.highlight pre{color:var(--text) !important;border-radius:4px;font-family:'Monaco', monospace;padding-top:1.5rem;padding-bottom:2rem;white-space:pre-wrap;word-wrap:break-word}.highlight table{display:grid;max-width:100%;margin-bottom:0;background:transparent}.highlight td,.highlight th{padding:0}.highlight .lntd{width:100%;border:none}.highlight .lntd:first-child,.highlight .lntd:first-child pre{width:2.5rem !important;padding-left:0;padding-right:0;color:rgba(255,255,255,0.5);user-select:none}.highlight .lntd:first-child pre{width:100%;display:flex;min-width:0;align-items:center;flex-direction:column}.err{color:#a61717}.hl{width:100%;background:var(--inline-color)}.ln,.lnt{margin-right:0.75rem;padding:0;transition:opacity 0.3s var(--ease)}.ln,.ln span,.lnt,.lnt span{color:var(--text);opacity:0.5;user-select:none}.k,.kc,.kd,.kn,.kp,.kr,.kt,.nt{color:#6ab825;font-weight:500}.kn,.kp{font-weight:400}.nb,.no,.nv{color:#24909d}.nc,.nf,.nn{color:#447fcf}.s,.sa,.sb,.sc,.dl,.sd,.s2,.se,.sh,.si,.sx,.sr,.s1,.ss{color:#ed9d13}.m,.mb,.mf,.mh,.mi,.il,.mo{color:#3677a9}.ow{color:#6ab825;font-weight:500}.c,.ch,.cm,.c1{color:#999;font-style:italic}.cs{color:#e50808;background-color:#520000;font-weight:500}.cp,.cpf{color:#cd2828;font-weight:500}.gd,.gr{color:#d22323}.ge{font-style:italic}.gh,.gu,.nd,.na,.ne{color:#ffa500;font-weight:500}.gi{color:#589819}.go{color:#ccc}.gp{color:#aaa}.gs{font-weight:500}.gt{color:#d22323}.w{color:#666}.hljs-string{color:#6ab825}.hljs-attr{color:#ed9d13}.p .hljs-attr{color:var(--light)}.pre_wrap{white-space:pre-wrap;white-space:-moz-pre-wrap;white-space:-pre-wrap;white-space:-o-pre-wrap;word-wrap:break-word}.pre_nolines.ln{display:none}.panel_box{display:inline-flex;perspective:300px;grid-gap:1rem;transition:opacity 0.3s var(--easing);background:var(--code-bg);padding:0.5rem 1.5rem;border-radius:2rem;align-items:center;position:absolute;right:0rem;top:-2.1rem;opacity:0;min-width:0}.panel_icon{display:inline-flex;align-items:center;justify-content:center;cursor:pointer;padding:0.1rem;transform-origin:50% 50%;margin:0;min-width:0}.panel_icon.active{animation:pulse 0.1s linear}.panel_icon svg{fill:var(--text);width:1.5rem;height:1.5rem}.panel_hide{display:none}.panel_from{position:absolute;color:var(--theme);bottom:0;font-size:1.5rem;font-weight:500;padding:0.5rem 0;cursor:pointer;letter-spacing:0.1px;z-index:19}.panel_expanded .panel_from{display:none}.shell{position:relative}.shell::before{content:"$";position:relative;margin-right:0.36rem}.line-flex{display:flex;min-width:0}@font-face{font-family:'Splunk Data Sans Pro';src:url("../fonts/SplunkDataSansPro_W_Rg.woff2") format("woff2");font-weight:400}@font-face{font-family:'Splunk Data Sans Pro';src:url("../fonts/SplunkDataSansPro_W_Bd.woff2") format("woff2");font-weight:700}body{font-family:'Splunk Data Sans Pro', Arial}p{font-weight:400}b,strong{font-weight:700}@keyframes chartjs-render-animation{0%{opacity:.99}100%{opacity:1}}.chartjs-render-monitor{animation:chartjs-render-animation 1ms}.chartjs-size-monitor,.chartjs-size-monitor-expand,.chartjs-size-monitor-shrink{position:absolute;direction:ltr;left:0;top:0;right:0;bottom:0;overflow:hidden;pointer-events:none;visibility:hidden;z-index:-1}.chartjs-size-monitor-expand>div{position:absolute;width:1000000px;height:1000000px;left:0;top:0}.chartjs-size-monitor-shrink>div{position:absolute;width:200%;height:200%;left:0;top:0}html[data-mode="dark"] .mermaid{--theme: darkgoldenrod;background-color:transparent !important;margin-bottom:2.5rem}html[data-mode="dark"] .mermaid svg{margin:0 auto;display:block}.tl-timeline{font-family:var(--font);background-color:var(--bg);color:var(--text)}.tl-timeline h1,.tl-timeline h2,.tl-timeline h3,.tl-timeline h4,.tl-timeline h5,.tl-timeline h6{color:var(--text)}.tl-timeline .tl-menubar{background-color:var(--bg)}.tl-timeline .tl-menubar-button{color:var(--text)}.tl-timeline .tl-timemarker-content-container{background-color:var(--bg);color:var(--text)}.tl-timeline .tl-headline-date,.tl-timeline .tl-headline{color:var(--text)}.tl-timeline .tl-text-content-container{background-color:var(--bg);color:var(--text)}.tl-timeline .tl-slide-content-container{background-color:var(--bg);color:var(--text)}.tl-timeline .tl-timemarker.tl-timemarker-active .tl-timemarker-content-container{background-color:var(--theme);color:var(--light)}.tl-timeline .tl-slidenav-next,.tl-timeline .tl-slidenav-previous{color:var(--text)}.tl-timeline .tl-slidenav-next:hover,.tl-timeline .tl-slidenav-previous:hover{color:var(--theme)}.tl-timeline .tl-slidenav-title{color:var(--theme);text-shadow:1px 1px 2px rgba(0,0,0,0.8)}.tl-timeline .tl-slidenav-description{color:var(--theme)}.tl-timeline .tl-timeaxis-background{background-color:var(--bg)}.tl-timeline .tl-timeaxis-minor .tl-timeaxis-tick,.tl-timeline .tl-timeaxis-major .tl-timeaxis-tick{border-color:var(--text)}.tl-timeline .tl-timeaxis-tick-text{color:var(--text)}.tl-timeline .tl-attribution{display:none}

/*# sourceMappingURL=styles.css.map */