Advantages

• Proven methodology

• Flexibility

  • levels of significance
  • prioritization of events

• Multiple levels - one to many relation

• Attack signature is not required

• Historical analysis