The Operational Role of Security Information and Event Management Systems
The base-rate fallacy and the difficulty of intrusion detection