https://www.sans.org/reading-room/whitepapers/detection/automated-network-defense-threat-intelligence-knowledge-management-36572