{"action":"created","issue":{"url":"https://api.github.com/repos/philhagen/sof-elk/issues/45","repository_url":"https://api.github.com/repos/philhagen/sof-elk","labels_url":"https://api.github.com/repos/philhagen/sof-elk/issues/45/labels{/name}","comments_url":"https://api.github.com/repos/philhagen/sof-elk/issues/45/comments","events_url":"https://api.github.com/repos/philhagen/sof-elk/issues/45/events","html_url":"https://github.com/philhagen/sof-elk/issues/45","id":177061694,"number":45,"title":"Move to 4-digit ordinals","user":{"login":"philhagen","id":428886,"avatar_url":"https://avatars.githubusercontent.com/u/428886?v=3","gravatar_id":"","url":"https://api.github.com/users/philhagen","html_url":"https://github.com/philhagen","followers_url":"https://api.github.com/users/philhagen/followers","following_url":"https://api.github.com/users/philhagen/following{/other_user}","gists_url":"https://api.github.com/users/philhagen/gists{/gist_id}","starred_url":"https://api.github.com/users/philhagen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philhagen/subscriptions","organizations_url":"https://api.github.com/users/philhagen/orgs","repos_url":"https://api.github.com/users/philhagen/repos","events_url":"https://api.github.com/users/philhagen/events{/privacy}","received_events_url":"https://api.github.com/users/philhagen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-15T01:00:18Z","updated_at":"2016-09-15T18:09:14Z","closed_at":null,"body":"0xxx = inputs\r\n0[0-4]xx = forensics\r\n0[5-9]xx = cyber defense\r\n9xxx = output\r\n0[0-4]xx = forensics\r\n0[5-9]xx = cyber defense\r\n\r\n* What are the classification buckets we want to use for filter/parse/enrich segments? Below is an option, but does this make sense?\r\n\r\n1xxx = network forensic\r\n2xxx = disk forensic\r\n3xxx = endpoint\r\n4xxx = service logs\r\n6xxx = siem\r\n"},"comment":{"url":"https://api.github.com/repos/philhagen/sof-elk/issues/comments/247405780","html_url":"https://github.com/philhagen/sof-elk/issues/45#issuecomment-247405780","issue_url":"https://api.github.com/repos/philhagen/sof-elk/issues/45","id":247405780,"user":{"login":"philhagen","id":428886,"avatar_url":"https://avatars.githubusercontent.com/u/428886?v=3","gravatar_id":"","url":"https://api.github.com/users/philhagen","html_url":"https://github.com/philhagen","followers_url":"https://api.github.com/users/philhagen/followers","following_url":"https://api.github.com/users/philhagen/following{/other_user}","gists_url":"https://api.github.com/users/philhagen/gists{/gist_id}","starred_url":"https://api.github.com/users/philhagen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philhagen/subscriptions","organizations_url":"https://api.github.com/users/philhagen/orgs","repos_url":"https://api.github.com/users/philhagen/repos","events_url":"https://api.github.com/users/philhagen/events{/privacy}","received_events_url":"https://api.github.com/users/philhagen/received_events","type":"User","site_admin":false},"created_at":"2016-09-15T18:09:14Z","updated_at":"2016-09-15T18:09:14Z","body":"More thinking on this...  I think something like the following structure may work:\r\n\r\n0xxx = inputs\r\n1xxx = pre-processors (e.g. syslog handling, etc)\r\n2xxx = network (e.g. netflow)\r\n3xxx = host (e.g. Plaso)\r\n6xxx = logs (e.g. application-specific)\r\n9xxx = outputs\r\n\r\nI'm not sure we should subdivide the inputs/outputs too broadly yet, though.  I could see allocating groups of 100 as needed, though."}}
{"actor":{"display_login":"philhagen"}}