https://www.sans.org/reading-room/whitepapers/OpenSource/ise6100-giac-enterprises-4-4-final-lessons-learned-36932