https://www.sans.org/reading-room/whitepapers/analyst/expanding-role-data-analytics-threat-detection-36362