)]}'
{"security-guide/ch_forensics-and-incident-response.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"98130cb25238535240b09a371db6bcb91c2dbaf2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    \u003cpara\u003eThe basics of logging: configuration, setting log level, location of the log files, and how to use and customize logs, as well as how to do centralized collections of logs is well covered in the \u003clink xlink:href\u003d\"http://docs.openstack.org/ops/\"\u003e\u003ccitetitle\u003eOpenStack Operations Guide\u003c/citetitle\u003e\u003c/link\u003e.\u003c/para\u003e"},{"line_number":12,"context_line":"    \u003cpara\u003eLogs are not only valuable for proactive security and continuous compliance activities, but they are also a valuable information source for investigating and responding to incidents.\u003c/para\u003e"},{"line_number":13,"context_line":"    \u003cpara\u003eFor instance, analyzing the access logs of Identity Service or its replacement authentication system would alert us to failed logins, their frequency, origin IP, whether the events are restricted to select accounts etc. Log analysis supports detection.\u003c/para\u003e"},{"line_number":14,"context_line":"    \u003cpara\u003eActions may be taken to mitigate potential malicious activity detected such as blacklisting an IP address, recommendating strengthening of user passwords, or in some cases de-activating a user account if it is deemed dormant.\u003c/para\u003e"},{"line_number":15,"context_line":"    \u003csection xml:id\u003d\"forensics-and-incident-response-idp60511\"\u003e"},{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eMonitoring events is more pro-active and provides real-time detection and response. There are several tools to aid in monitoring.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"baada198_0e82b851","line":14,"updated":"2014-07-19 15:24:55.000000000","message":"recommendating? Shouldn\u0027t this be recomending?","commit_id":"05f15c759f66e9d5fcd4af07f3069bb5af0f8bf5"}]}