http://infosecnirvana.com/arcsight-corr-install/
http://www.softpanorama.org/Admin/Event_correlation/perl_based_event_correlation.shtml
