https://www.sans.org/reading-room/whitepapers/OpenSource/ise6100-giac-enterprises-open-source-siem-read-first-36952