Network Intrusion Analysis: Methodologies, Tools, and Techniques for Incident Analysis and Response
Not only does this book teach you about network intrusion analysis, it also gives you knowledge of how intrusions are performed.  This inside information helps give you a better picture of what's really going on when you are investigating a compromise. -Derrick Rountree, CISSP, CASP, MCSE