Security Monitoring is technically correct, but its approach to incident detection will fall far short of what is needed in the real world. At just over 200 pages, it’s not written to be much more than that. Richard Bejtlich: SM concentrates on a paradigm it calls “policy-based monitoring,” (abbreviated PBM here) This sounds great, but it has several real flaws Please read the rest of the review for the whole story. Back to Mail Online home.”]
Source: https://taosecurity.blogspot.com/2009/07/review-of-security-monitoring-posted.html