Any reviews of Practical Intrusion Analysis by Ryan Trost?  I was wondering how people thought it compared to previous IDS/IPS books (notice I said "IDS" and NOT "SNORT")?

Flipping through it at Borders, I do like the amount of ground covered!

Anybody use geospatial intrusion detection (the usage of geographical endpoints for a measure of IDS/IPS analysis)?  I skimmed the chapter and might simply buy it for that one chapter.

I really enjoyed the book myself.

The chapter on netflow was informative and insightful.  Especially given the amount of emphasis security practitioners are putting on the technology (thankfully to netflow gurus like jose nazario -- conficker finder).

I also really enjoyed the physical security chapter.  Rarely do technical books dive into that topic which is unfortunate since physical breaches are the easiest! 

The included WAF chapter is essential these days.  Typical signature based NIDS are too easy to evade. 

I give it 4 out of 5 stars...