Charles:  Replace the following part of section5.tex...

\paragraph{Log Review and Annotation:}

\subsubsection*{Log review and annotation}

with:

\paragraph{Log Review and Annotation:}

MITRE is also developing a log review and annotation tool to
distribute with the logger.  It allows users to view the data that has
been logged for a given session.  One may view all the data or select
a subset by application, datatype and/or timestamp.  The data is
displayed along a scrollable timeline, with the data sorted into
streams by application and datatype.

This tool may also be used to add post-hoc annotations to the data,
linking sets of points to user-produced text.  The annotations will
also appear as datapoints in the log session, and may themselves have
further annotations applied to them.

There is also a replay facility which will allow the reviewer to
replay the logged interaction in approximately real time.  Currently
an initial implementation exists, which will be improved and revised
as users begin to provide feedback.




-----------------------

Thanks,
--Robyn