Security News > 2016 > August > Incident Handling Preparation: Learning Normal with the Kansa PowerShell Incident Response Framework (SANS Reading Room)