The security process -- What is network security monitoring? -- Deployment considerations -- The reference intrusion model -- Full content data -- Additional data analysis -- Session data -- Statistical data -- Alert data : Bro and Prelude -- Alert data : NSM using Sguil -- Best practices -- Case studies for managers -- Analyst training program -- Discovering DNS -- Harnessing the power of session data -- Packet monkey heaven -- Tools for attacking network security monitoring -- Tactics for attacking network security monitoring.