As Anton Chuvakin recently mentioned on his blog, we are starting some research on the work around security monitoring use cases: from the basic identification of candidates to prioritization, implementation, tuning and even retiring use cases. It is a crucial component of security monitoring practices but there are not many places you can get good information or best practices about it.