Today, when a security accident occurs, the top three questions security administrators ask are: What has happened? Why did it happen? What should I do? Answers to the first two questions form the 'core' of "Cyber Situational Awareness". Whether the last question can be well answered is greatly depe[...]