)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"cf540d9948246fe13e6f963289147cba9145a790","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Shellee Arnold \u003cshellee.arnold@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2014-08-24 21:22:05 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Grammatical errors in chapter 45"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Reworded sentence in paragraph to correct grammatical errors, also made other corrections to remediate other grammatical errors in subsequent paragraphs."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1abeadc6_6de679ea","line":7,"updated":"2014-08-25 04:50:54.000000000","message":"Better name the chapter than just the number","commit_id":"1ac3873f1107dc8b1b80d50c0ff7ad85951575d8"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"cf540d9948246fe13e6f963289147cba9145a790","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Grammatical errors in chapter 45"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Reworded sentence in paragraph to correct grammatical errors, also made other corrections to remediate other grammatical errors in subsequent paragraphs."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I4f9d92b8db3068004ec4e72ecbdae88f2884ddd0"},{"line_number":12,"context_line":"Closes-Bug: ##1342968"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1abeadc6_4de1bdcf","line":9,"updated":"2014-08-25 04:50:54.000000000","message":"Please limit your line to 72 chars, this is a bit long...","commit_id":"1ac3873f1107dc8b1b80d50c0ff7ad85951575d8"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"cf540d9948246fe13e6f963289147cba9145a790","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Reworded sentence in paragraph to correct grammatical errors, also made other corrections to remediate other grammatical errors in subsequent paragraphs."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I4f9d92b8db3068004ec4e72ecbdae88f2884ddd0"},{"line_number":12,"context_line":"Closes-Bug: ##1342968"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1abeadc6_8debd5af","line":12,"updated":"2014-08-25 04:50:54.000000000","message":"One \"#\" is enough","commit_id":"1ac3873f1107dc8b1b80d50c0ff7ad85951575d8"}],"security-guide/section_forensics-and-incident-response.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"cf540d9948246fe13e6f963289147cba9145a790","unresolved":false,"context_lines":[{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eEvent monitoring is a more pro-active approach to securing an environment, providing real-time detection and response. Several tools exist which can aid in monitoring.\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cpara\u003eIn the case of an OpenStack cloud instance, we need to monitor the hardware, the OpenStack services, and the cloud resource usage. The latter stems from wanting to be elastic, to scale to the dynamic needs of the users.\u003c/para\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eHere are a few important use cases to consider when implementing log aggregation, analysis and monitoring. These use cases can be implemented and monitored through various commercial or open source scripts(in-house), applications or other tooling. The tools and scripts can generate events that can be sent to administrators through email or integrated dashboard. It is important to consider additional use cases that may apply to your specific network and what you may consider anomalous behavior.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":21,"context_line":"        \u003cpara\u003eDetecting the absence of log generation is an event of high value. Such an event would indicate a service failure or even an intruder who has temporarily switched off logging or modified the log level to hide their tracks.\u003c/para\u003e"},{"line_number":22,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"1abeadc6_edd9a923","line":19,"updated":"2014-08-25 04:50:54.000000000","message":"Add a space before \"(in-house)\".","commit_id":"1ac3873f1107dc8b1b80d50c0ff7ad85951575d8"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"cf540d9948246fe13e6f963289147cba9145a790","unresolved":false,"context_lines":[{"line_number":26,"context_line":"      \u003c/listitem\u003e"},{"line_number":27,"context_line":"\u003c/itemizedlist\u003e"},{"line_number":28,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":29,"context_line":"        \u003cpara\u003eOS events on the OpenStack service machines such as user logins or restarts also provide valuable insight into use/misuse\u003c/para\u003e"},{"line_number":30,"context_line":"      \u003c/listitem\u003e"},{"line_number":31,"context_line":"\u003c/itemizedlist\u003e"},{"line_number":32,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"1abeadc6_2d03a177","line":29,"updated":"2014-08-25 04:50:54.000000000","message":"Could you change \"use/misuse\", please? Let\u0027s replace the \"/\" with different wording.","commit_id":"1ac3873f1107dc8b1b80d50c0ff7ad85951575d8"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"241b75f5490b2d569848b648b3d5e444c761d61f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    \u003cpara\u003eActions may be taken to mitigate potential malicious activity such as blacklisting an IP address, recommending the strengthening of user passwords, or de-activating a user account if it is deemed dormant.\u003c/para\u003e"},{"line_number":15,"context_line":"    \u003csection xml:id\u003d\"forensics-and-incident-response-idp60511\"\u003e"},{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eEvent monitoring is a more pro-active approach to securing an environment, providing real-time detection and response. Several tools exist which can aid in monitoring.\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cpara\u003eIn the case of an OpenStack cloud instance, we need to monitor the hardware, the OpenStack services, and the cloud resource usage. The latter stems from wanting to be elastic, to scale to the dynamic needs of the users.\u003c/para\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eHere are a few important use cases to consider when implementing log aggregation, analysis and monitoring. These use cases can be implemented and monitored through various commercial or open source scripts (in-house), applications or other tooling. The tools and scripts can generate events that can be sent to administrators through email or integrated dashboard. It is important to consider additional use cases that may apply to your specific network and what you may consider anomalous behavior.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_8e10baa9","line":17,"updated":"2014-09-02 08:26:29.000000000","message":"Which tools? Would be nice to mention them.","commit_id":"13daccbf07ed02b43ed5be6eb5a7001a5c216431"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"c03cc9744632d671cdbb99a845d6ee7f9ab1beaa","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    \u003cpara\u003eActions may be taken to mitigate potential malicious activity such as blacklisting an IP address, recommending the strengthening of user passwords, or de-activating a user account if it is deemed dormant.\u003c/para\u003e"},{"line_number":15,"context_line":"    \u003csection xml:id\u003d\"forensics-and-incident-response-idp60511\"\u003e"},{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eEvent monitoring is a more pro-active approach to securing an environment, providing real-time detection and response. Several tools exist which can aid in monitoring.\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cpara\u003eIn the case of an OpenStack cloud instance, we need to monitor the hardware, the OpenStack services, and the cloud resource usage. The latter stems from wanting to be elastic, to scale to the dynamic needs of the users.\u003c/para\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eHere are a few important use cases to consider when implementing log aggregation, analysis and monitoring. These use cases can be implemented and monitored through various commercial or open source scripts (in-house), applications or other tooling. The tools and scripts can generate events that can be sent to administrators through email or integrated dashboard. It is important to consider additional use cases that may apply to your specific network and what you may consider anomalous behavior.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_51a0c08f","line":17,"in_reply_to":"fa98f980_8e10baa9","updated":"2014-09-14 09:47:41.000000000","message":"Indeed but outside of the scope of this patch.","commit_id":"13daccbf07ed02b43ed5be6eb5a7001a5c216431"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"241b75f5490b2d569848b648b3d5e444c761d61f","unresolved":false,"context_lines":[{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eEvent monitoring is a more pro-active approach to securing an environment, providing real-time detection and response. Several tools exist which can aid in monitoring.\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cpara\u003eIn the case of an OpenStack cloud instance, we need to monitor the hardware, the OpenStack services, and the cloud resource usage. The latter stems from wanting to be elastic, to scale to the dynamic needs of the users.\u003c/para\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eHere are a few important use cases to consider when implementing log aggregation, analysis and monitoring. These use cases can be implemented and monitored through various commercial or open source scripts (in-house), applications or other tooling. The tools and scripts can generate events that can be sent to administrators through email or integrated dashboard. It is important to consider additional use cases that may apply to your specific network and what you may consider anomalous behavior.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":21,"context_line":"        \u003cpara\u003eDetecting the absence of log generation is an event of high value. Such an event would indicate a service failure or even an intruder who has temporarily switched off logging or modified the log level to hide their tracks.\u003c/para\u003e"},{"line_number":22,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_8e5efa74","line":19,"updated":"2014-09-02 08:26:29.000000000","message":"\"open source scripts (in-house)\" does not make sense for me.","commit_id":"13daccbf07ed02b43ed5be6eb5a7001a5c216431"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"c03cc9744632d671cdbb99a845d6ee7f9ab1beaa","unresolved":false,"context_lines":[{"line_number":16,"context_line":"        \u003ctitle\u003eMonitoring use cases\u003c/title\u003e"},{"line_number":17,"context_line":"    \u003cpara\u003eEvent monitoring is a more pro-active approach to securing an environment, providing real-time detection and response. Several tools exist which can aid in monitoring.\u003c/para\u003e"},{"line_number":18,"context_line":"    \u003cpara\u003eIn the case of an OpenStack cloud instance, we need to monitor the hardware, the OpenStack services, and the cloud resource usage. The latter stems from wanting to be elastic, to scale to the dynamic needs of the users.\u003c/para\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eHere are a few important use cases to consider when implementing log aggregation, analysis and monitoring. These use cases can be implemented and monitored through various commercial or open source scripts (in-house), applications or other tooling. The tools and scripts can generate events that can be sent to administrators through email or integrated dashboard. It is important to consider additional use cases that may apply to your specific network and what you may consider anomalous behavior.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":21,"context_line":"        \u003cpara\u003eDetecting the absence of log generation is an event of high value. Such an event would indicate a service failure or even an intruder who has temporarily switched off logging or modified the log level to hide their tracks.\u003c/para\u003e"},{"line_number":22,"context_line":"      \u003c/listitem\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa98f980_71ab0475","line":19,"in_reply_to":"fa98f980_8e5efa74","updated":"2014-09-14 09:47:41.000000000","message":"I\u0027ve reworked the paragraph completely.","commit_id":"13daccbf07ed02b43ed5be6eb5a7001a5c216431"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":65,"context_line":"      Here are a few important use cases to consider when implementing"},{"line_number":66,"context_line":"      log aggregation, analysis and monitoring. These use cases can be"},{"line_number":67,"context_line":"      implemented and monitored through various applications, tools or"},{"line_number":68,"context_line":"      scripts. There are open source and commercial solutions and somef"},{"line_number":69,"context_line":"      operators develop their own in-house solutions. These tools and"},{"line_number":70,"context_line":"      scripts can generate events that can be sent to administrators"},{"line_number":71,"context_line":"      through email or integrated dashboard. It is important to"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_2d72c611","line":68,"updated":"2014-09-16 16:27:28.000000000","message":"typo - \"somef\"","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":68,"context_line":"      scripts. There are open source and commercial solutions and somef"},{"line_number":69,"context_line":"      operators develop their own in-house solutions. These tools and"},{"line_number":70,"context_line":"      scripts can generate events that can be sent to administrators"},{"line_number":71,"context_line":"      through email or integrated dashboard. It is important to"},{"line_number":72,"context_line":"      consider additional use cases that may apply to your specific"},{"line_number":73,"context_line":"      network and what you may consider anomalous behavior."},{"line_number":74,"context_line":"    \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_cd513a65","line":71,"updated":"2014-09-16 16:27:28.000000000","message":"\"the\" integrated dashboard?  Or even \"viewed in the integrated dashboard\"?","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":83,"context_line":"      \u003c/listitem\u003e"},{"line_number":84,"context_line":"      \u003clistitem\u003e"},{"line_number":85,"context_line":"        \u003cpara\u003e"},{"line_number":86,"context_line":"          Application events such as start and/or stop that were"},{"line_number":87,"context_line":"          unscheduled would also be events to monitor and examine for"},{"line_number":88,"context_line":"          possible security implications."},{"line_number":89,"context_line":"        \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_add4f6bd","line":86,"updated":"2014-09-16 16:27:28.000000000","message":"I would add \"events\" after \"stop\" to aid in readability:\n\n  \"...such as start and/or stop events that...\"","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":90,"context_line":"      \u003c/listitem\u003e"},{"line_number":91,"context_line":"      \u003clistitem\u003e"},{"line_number":92,"context_line":"        \u003cpara\u003e"},{"line_number":93,"context_line":"          OS events on the OpenStack service machines such as user"},{"line_number":94,"context_line":"          logins or restarts also provide valuable insight into proper"},{"line_number":95,"context_line":"          and improper usage of systems."},{"line_number":96,"context_line":"        \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_6df12e6a","line":93,"updated":"2014-09-16 16:27:28.000000000","message":"Should we say \"Operating system events\" to avoid ambiguity?","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":117,"context_line":"          discussion to generate notifications in the system and have"},{"line_number":118,"context_line":"          OpenStack components respond to these events as appropriate"},{"line_number":119,"context_line":"          such as terminating instances, disconnecting attached"},{"line_number":120,"context_line":"          volumes, reclaiming CPU and storage resources and so on."},{"line_number":121,"context_line":"        \u003c/para\u003e"},{"line_number":122,"context_line":"      \u003c/listitem\u003e"},{"line_number":123,"context_line":"    \u003c/itemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_8d6bb2f0","line":120,"updated":"2014-09-16 16:27:28.000000000","message":"(nit) This is a really long sentence.  It would be ideal to break it up so it is easier to read.  The mention of \"discussion\" seems a bit odd too.  Is this saying that developers are discussing adding this behaviour?","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"580fd71dd2398dd5476cc38e1ddf2e183351f724","unresolved":false,"context_lines":[{"line_number":117,"context_line":"          discussion to generate notifications in the system and have"},{"line_number":118,"context_line":"          OpenStack components respond to these events as appropriate"},{"line_number":119,"context_line":"          such as terminating instances, disconnecting attached"},{"line_number":120,"context_line":"          volumes, reclaiming CPU and storage resources and so on."},{"line_number":121,"context_line":"        \u003c/para\u003e"},{"line_number":122,"context_line":"      \u003c/listitem\u003e"},{"line_number":123,"context_line":"    \u003c/itemizedlist\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_c3ff4934","line":120,"in_reply_to":"fa98f980_8d6bb2f0","updated":"2014-09-16 17:34:04.000000000","message":"I have no idea about this.","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"7433b7db7a0394e6af8d1bdcf0ce9a1737486437","unresolved":false,"context_lines":[{"line_number":132,"context_line":"      utilities can generate logs that show when and how an attack or"},{"line_number":133,"context_line":"      intrusion took place. Deploying these tools on the cloud"},{"line_number":134,"context_line":"      machines provides value and protection. Cloud users, those"},{"line_number":135,"context_line":"      running instances on the cloud may also want to run such tools"},{"line_number":136,"context_line":"      on their instances."},{"line_number":137,"context_line":"    \u003c/para\u003e"},{"line_number":138,"context_line":"    \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa98f980_4d48ea8a","line":135,"updated":"2014-09-16 16:27:28.000000000","message":"(nit) Add a \u0027,\u0027 after \"on the cloud\".","commit_id":"758d7c92631fd91ea2a2f028003aee8307fcbb71"}]}