https://www.sans.org/reading-room/whitepapers/OpenSource/ise6100-giac-enterprises-3-4-final-presentation-36937