{"action":"opened","issue":{"url":"https://api.github.com/repos/jstirnaman/shareabouts/issues/49","repository_url":"https://api.github.com/repos/jstirnaman/shareabouts","labels_url":"https://api.github.com/repos/jstirnaman/shareabouts/issues/49/labels{/name}","comments_url":"https://api.github.com/repos/jstirnaman/shareabouts/issues/49/comments","events_url":"https://api.github.com/repos/jstirnaman/shareabouts/issues/49/events","html_url":"https://github.com/jstirnaman/shareabouts/issues/49","id":164471415,"number":49,"title":"New EZProxy Event","user":{"login":"jstirnaman","id":212227,"avatar_url":"https://avatars.githubusercontent.com/u/212227?v=3","gravatar_id":"","url":"https://api.github.com/users/jstirnaman","html_url":"https://github.com/jstirnaman","followers_url":"https://api.github.com/users/jstirnaman/followers","following_url":"https://api.github.com/users/jstirnaman/following{/other_user}","gists_url":"https://api.github.com/users/jstirnaman/gists{/gist_id}","starred_url":"https://api.github.com/users/jstirnaman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jstirnaman/subscriptions","organizations_url":"https://api.github.com/users/jstirnaman/orgs","repos_url":"https://api.github.com/users/jstirnaman/repos","events_url":"https://api.github.com/users/jstirnaman/events{/privacy}","received_events_url":"https://api.github.com/users/jstirnaman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-08T07:05:58Z","updated_at":"2016-07-08T07:05:58Z","closed_at":null,"body":"Some EventsThis notification was generated by the EZProxy monitor script. The triggering events may or may not be legitimate use and will require investigation and communication with the user. This document describes incoming EZProxy notifications of possible abuse of library resources and steps that Galter Library Digital Systems and Collections group will take to investigate and prevent further abuse. # Service Commitment Respond to all events... * within the same working day when notified on normal working days,  * within 24 hours when notified during weekends or holidays. # Responding to EZProxy Events notification - [ ] Find EZProxy log lines for the user’s session prior to the reported events. If same day, Resources Librarian can use EZProxy Admin to find log lines containing the username, ie email address. Otherwise, Library Developer can extract log file data and send to Resources Librarian and/or help with analysis. - [ ] Search WHOIS online to verify EZProxy's IP geolocation for any IP address outside the U.S.- [ ] If the event is BlockCountryChange, determine whether originating IP is outside the US? If so, user may be travelling. Look at subsequent IP addresses for the same session ID.- [ ] Determine whether IP address that the user changed to a Northwestern IP, e.g. VPN, or an IP address from a cellular network, e.g. Portable hotspot wifi?- [ ] If log activity indicates abuse then Resources Librarian will notify the user (see the _Sample User Notification_) that we have detected suspicious activity from user's account.- [ ] If user verifies that this is legitimate use then notify Galter-IS of a false-positive. Even though EZProxy will indicate a BlockCountryChange for the user, the user will not actually be blocked since our site generates a new EZProxy session. - [ ] If user verifies that the use is illegitimate then Resources Librarian will reply to user to encourage taking appropriate steps, copying NUL and NUIT Security. Follow steps in _Resolving Compromised EZProxy Sessions_. # Resolving Compromised EZProxy Sessions - [ ] In EZProxy Admin, end all active sessions associated with the user account reported in the EZProxy notification:   1. Sign in to Galter web site and enable Force Proxy on your account.  2. Go to EZProxy Admin > View Server Status.  3. For each Sessions table row containing the user’s email address, click the Session link and then click Terminate Session. - [ ] Deactivate user’s Galter website account. In Admin > Users > User Account > Edit User,  set Active to “No”. - [ ] Reactivate Galter website account once user responds that he has reset his password. - [ ] Notify user, NUL, and NUIT Security of resolution. # Sample User Notification USER,Your Galter Library access was flagged for suspicious activity:  2016-07-07 03:16:31 BlockCountryChange 69.4.227.169 Session country CN## What this means:During your session, a Chinese IP address was used to access library resourcesand then the IP address location changed during the session.This is a pattern common to illegal pirating of content.## What you should do:If you recognize this as your use, please reply to this emailso we can prevent you from being suspended in and improve our monitoring.If you do not recognize this activity then your Northwestern NetID passwordmay have been compromised and you should change your password and security questions immediately.You should change your security questions since the attacker may have accessed your account and read your security questions and answers, making it possible for them to change your password and use your account in the future.For assistance, contact the NUIT Help Desk by dialing 1-HELP (1-4357) onany campus phone or can dial (847) 491-4357.They will assist you with changing your passwords and security questions.Regards,YOUR NAMEGalter Library Digital Services and Collections"}}
{"actor":{"display_login":"jstirnaman"}}