[ossec-list] Log correlation best practices and white papers

[william maddler]

Hi all,
does anyone could point to some existing good document about correlation
best practices and/or white papers?

Thank you all.
William