Security Indications and Warnings

• Premise - historical events, can be used as indicators current of activity.

• Host-based Intrusion Detection

  • why? audit log analysis
  • network based possible

• Not scenario matching