https://www.sans.org/reading-room/whitepapers/incident/incident-handling-preparation-learning-normal-kansa-powershell-incident-response-framewor-37192