Part II posted here:

http://blogs.cisco.com/security/making-boring-logs-interesting/

The series will be available at this link as they are posted:

http://blogs.cisco.com/tag/csirt-playbook

Thanks!