Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    IBM RACF

    JSA includes two options for integrating event from IBM®RACF®.

    See the following options:

    Integrate IBM RACF with JSA Using IBM Security ZSecure

    The IBM®RACF® DSM allows the integration of events from an IBM z/OS® mainframe by using IBM® Security zSecure.

    Using a zSecure process, events from the System Management Facilities (SMF) are recorded to an event file in the Log Enhanced Event format (LEEF). JSA retrieves the LEEF event log files by using the log file protocol and processes the events. You can schedule JSA to retrieve events on a polling interval, which allows JSA to retrieve the events on the defined schedule.

    To integrate IBM®RACF® LEEF events:

    1. Confirm that your installation meets any prerequisite installation requirements. For more information, see Before you begin.

    2. Configure your IBM z/OS image to write events in LEEF format. For more information, see the IBM® Security zSecure Suite: CARLa-Driven Components Installation and Deployment Guide.

    3. Create a log source in JSA for IBM® RACF® to retrieve your LEEF formatted event logs. For more information, see Creating an IBM RACF Log Source in JSAThe log file protocol allows JSA to retrieve archived log files from a remote host..

    4. Optional. Create a custom event property for IBM® RACF® in JSA. For more information, see the JSA Custom Event Properties for IBM z/OS technical note.

    Before You Begin

    Before you can configure the data collection process, you must complete the basic zSecure installation process.

    The following prerequisites are required:

    • You must ensure parmlib member IFAPRDxx is enabled for IBM® Security zSecure Audit on your z/OS® image.

    • The SCKRLOAD library must be APF-authorized.

    • You must configure a process to periodically refresh your CKFREEZE and UNLOAD data sets.

    • You must configure an SFTP, FTP, or SCP server on your z/OS® image for JSA to download your LEEF event files.

    • You must allow SFTP, FTP, or SCP traffic on firewalls that are located between JSA and your z/OS® image.

    When the software is installed, you must complete the post-installation activities to create and modify the configuration. For instructions on installing and configuring zSecure, see the IBM® Security zSecure Suite: CARLa-Driven Components Installation and Deployment Guide.

    Creating an IBM RACF Log Source in JSA

    The log file protocol allows JSA to retrieve archived log files from a remote host.

    Log files are transferred, one at a time, to JSA for processing. The log file protocol can manage plain text event logs, compressed files, or archives. Archives must contain plain-text files that can be processed one line at a time. Multi-line event logs are not supported by the log file protocol. IBM z/OS with zSecure writes log files to a specified directory as gzip archives. JSA extracts the archive and processes the events, which are written as one event per line in the file.

    To retrieve these events, you must create a log source by using the log file protocol. JSA requires credentials to log in to the system that hosts your LEEF formatted event files and a polling interval.

    1. Click the Admin tab.
    2. Click the Log Sources icon.
    3. Click Add.
    4. In the Log Source Name field, type a name for the log source.
    5. In the Log Source Description field, type a description for the log source.
    6. From the Log Source Type list, select IBM® Resource Access Control Facility (RACF®).
    7. From the Protocol Configuration list, select Log File.
    8. Configure the following values:

      Table 1: IBM RACF Log File Protocol Parameters

      Parameter

      Description

      Log Source Identifier

      Type an IP address, host name, or name to identify the event source. IP addresses or host names are recommended identifiers as they allow JSA to identify a log file to a unique event source.

      For example, if your network contains multiple devices, such as multiple z/OS® images or a file repository that contains all of your event logs, specify a name, IP address, or host name for the image or location that uniquely identifies events for the IBM®RACF® log source. This specification allows events to be identified at the image or location level in your network that your users can identify.

      Service Type

      From the list, select the protocol that you want to use when retrieving log files from a remote server. The default is SFTP.

      • SFTP SSH File Transfer Protocol

      • FTP File Transfer Protocol

      • SCP Secure Copy

      The underlying protocol that is used to retrieve log files for the SCP and SFTP service type requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.

      Remote IP or Hostname

      Type the IP address or host name of the device that stores your event log files.

      Remote Port

      Type the TCP port on the remote host that is running the selected Service Type. The valid range is 1 - 65535.

      The options include the following ports:

      • FTP TCP Port 21

      • SFTP TCP Port 22

      • SCP TCP Port 22

      If the host for your event files is using a non-standard port number for FTP, SFTP, or SCP, you must adjust the port value.

      Remote User

      Type the user name or user ID necessary to log in to the host that contains your event files.

      • If your log files are on your IBM z/OS image, type the user ID necessary to log in to your IBM z/OS. The user ID can be up to 8 characters in length.

      • If your log files are on a file repository, type the user name necessary to log in to the file repository. The user name can be up to 255 characters in length.

      Remote Password

      Type the password necessary to log in to the host.

      Confirm Password

      Confirm the password necessary to log in to the host.

      SSH Key File

      If you select SCP or SFTP as the Service Type, this parameter allows the definition of an SSH private key file. When you provide an SSH Key File, the Remote Password field is ignored.

      Remote Directory

      Type the directory location on the remote host from which the files are retrieved, relative to the user account you are using to log in.

      Recursive

      Select this check box if you want the file pattern to search sub folders in the remote directory. By default, the check box is clear.

      The Recursive option is ignored if you configure SCP as the Service Type.

      FTP File Pattern

      If you select SFTP or FTP as the Service Type, this option allows the configuration of the regular expression (regex) needed to filter the list of files that are specified in the Remote Directory. All matching files are included in the processing.

      IBM z/OS mainframe that uses IBM® Security zSecure Audit writes event files by using the pattern RACF.<timestamp>.gz

      The FTP File Pattern that you specify must match the name you assigned to your event files. For example, to collect files that start with zOS and end with .gz, type the following code:

      RACF®.*\.gz

      Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

      FTP Transfer Mode

      This option only displays if you select FTP as the Service Type.

      The binary transfer mode is required for event files that are stored in a binary or compressed format, such as zip, gzip, tar, or tar+gzip archive files.

      SCP Remote File

      If you select SCP as the Service Type you must type the file name of the remote file.

      Start Time

      Type the time of day you want the processing to begin. For example, type 00:00 to schedule the log file protocol to collect event files at midnight.

      This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files. Type the start time, based on a 24-hour clock, in the following format: HH: MM.

      Recurrence

      Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D).

      For example, type 2H if you want the remote directory to be scanned every 2 hours from the start time. The default is 1H.

      Run On Save

      Select this check box if you want the log file protocol to run immediately after you click Save.

      After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule.

      Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File parameter.

      EPS Throttle

      Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 - 5000.

      Processor

      From the list, select gzip.

      Processors allow event file archives to be expanded and the contents to be processed for events. Files are only processed after they are downloaded to JSA. JSA can process files in zip, gzip, tar, or tar+gzip archive format.

      Ignore Previously Processed File(s)

      Select this check box to track and ignore previously processed files that were processed by the log file protocol.

      JSA examines the log files in the remote directory to determine if a file was processed by the log file protocol. If a previously processed file is detected, the log file protocol does not download the file for processing. All files that are not processed previously are downloaded.

      This option applies only to FTP and SFTP Service Types.

      Change Local Directory?

      Select this check box to define a local directory on your JSA for storing downloaded files during processing.

      Leave this check box clear. When this check box is selected, the Local Directory field is displayed, allowing for the configuration of the local directory to use for storing files.

      Event Generator

      From the Event Generator list, select LineByLine.

      The Event Generator applies more processing to the retrieved event files. Each line of the file is a single event. For example, if a file has 10 lines of text, 10 separate events are created.

    9. Click Save.
    10. On the Admin tab, click Deploy Changes.

      The IBM®RACF® configuration is complete. If your IBM®RACF® requires custom event properties, see the JSA Custom Event Properties for IBM z/OS technical note.

    Integrate IBM RACF with JSA by Using Audit Scripts

    The IBM® Resource Access Control Facility (RACF®®) DSM for JSA allows the integration with an IBM z/OS mainframe by using IBM®RACF® for auditing transactions.

    JSA records all relevant and available information from the event.

    Note: zSecure integration is the only integration that provides custom events to the log source. Custom events can be displayed even when you collect events by using the Native QEXRACF integration.

    Use the following procedure to integrate the IBM®RACF® events into JSA:

    1. The IBM® mainframe system records all security events as Service Management Framework (SMF) records in a live repository.

    2. At midnight, the IBM® RACF® data is extracted from the live repository by using the SMF dump utility. The RACFICE utility IRRADU00 (an IBM® utility) creates a log file that contains all of the events and fields from the previous day in an SMF record format.

    3. The QEXRACF program pulls data from the SMF formatted file. The program pulls only the relevant events and fields for JSA and writes that information in a condensed format for compatibility. The information is also saved in a location accessible by JSA.

    4. JSA uses the log file protocol source to pull the QEXRACF output file and retrieves the information on a scheduled basis. JSA then imports and process this file.

    Configuring IBM RACF to Integrate with JSA

    You can integrate an IBM® mainframe RACF® with JSA.

    1. Download the qexracf_bundled.tar.gz .
    2. On a Linux-based operating system, use the following command to extract the file:

      tar -zxvf qexracf_bundled.tar.gz

      The following files are contained in the archive:

      • qexracf_jcl.txt

      • qexracfloadlib.trs

      • qexracf_trsmain_JCL.txt

    3. Load the files onto the IBM® mainframe by using any terminal emulator file transfer method.

      Upload the qexracf_trsmain_JCL.txt and qexracf_jcl.txt files by using the TEXT protocol.

      Upload the QexRACF loadlib.trs file by using binary mode and append to a preallocated data set. The QexRACF loadlib.trs file is a tersed file that contains the executable (the mainframe program QEXRACF).

      When you upload the .trs file from a workstation, preallocate a file on the mainframe with the following DCB attributes: DSORG=PS, RECFM=FB, LRECL=1024, BLKSIZE=6144. The file transfer type must be binary mode and not text.

    4. Customize the qexracf_trsmain_JCL.txt file according to your installation-specific requirements.

      The qexracf_trsmain_JCL.txt file uses the IBM® utility Trsmain to decompress the program that is stored in the QexRACF loadlib.trs file.

      The following is an example of the qexracf_trsmain_JCL.txt file includes the following code:

      //TRSMAIN JOB (yourvalidjobcard),Q1labs, 
      // MSGCLASS=V //DEL EXEC PGM=IEFBR14 
      //D1 DD DISP=(MOD,DELETE),DSN=<yourhlq>.QEXRACF.TRS // UNIT=SYSDA, 
      // SPACE=(CYL,(10,10)) 
      //TRSMAIN EXEC PGM=TRSMAIN,PARM='UNPACK' 
      //SYSPRINT DD SYSOUT=*,DCB=(LRECL=133,BLKSIZE=12901,RECFM=FBA) 
      //INFILE DD DISP=SHR,DSN=<yourhlq>.QEXRACF.TRS 
      //OUTFILE DD DISP=(NEW,CATLG,DELETE), 
      // DSN=<yourhlq>.LOAD, 
      // SPACE=(CYL,(10,10,5),RLSE),UNIT=SYSDA // 

      You must update the file with your installation specific information for parameters, such as, jobcard, data set naming conventions, output destinations, retention periods, and space needs.

      The .trs input file is an IBM® TERSE formatted library and is extracted by running the JCL, which calls the TRSMAIN. This tersed file, when extracted, creates a PDS linklib with the QEXRACF program as a member.

    5. You can STEPLIB to this library or choose to move the program to one of the LINKLIBs that are in the LINKLST. The program does not require authorization.
    6. When the upload is complete, copy the program to an existing link listed library or add a STEPLIB DD statement that has the correct dataset name of the library that will contain the program.
    7. The qexracf_jcl.txt file is a text file that contains a sample JCL deck to provide you with the necessary JCL to run the IBM® IRRADU00 utility. This allows JSA to obtain the necessary IBM® RACF® events. Configure the job card to meet your local standards.

      An example of the qexracf_jcl.txt file has the following code.

      //QEXRACF JOB (<your valid jobcard>),Q1LABS, 
      // MSGCLASS=P, // REGION=0M //* 
      //*QEXRACF JCL version 1.0 April 2009 //* 
      //************************************************************* 
      //* Change below dataset names to sites specific datasets names * 
      //************************************************************* 
      //SET1 SET SMFOUT='<your hlq>.CUSTNAME.IRRADU00.OUTPUT', 
      // SMFIN='<your SMF dump ouput dataset>', 
      // QRACFOUT='<your hlq>.QEXRACF.OUTPUT' 
      //************************************************************* 
      //* Delete old datasets * 
      //************************************************************* 
      //DEL EXEC PGM=IEFBR14 //DD2 DD DISP=(MOD,DELETE),DSN=&QRACFOUT, 
      // UNIT=SYSDA, // SPACE=(TRK,(1,1)), // DCB=(RECFM=FB,LRECL=80) 
      //************************************************************* 
      //* Allocate new dataset *
      //************************************************************* 
      //ALLOC EXEC PGM=IEFBR14 
      //DD1 DD DISP=(NEW,CATLG),DSN=&QRACFOUT, 
      // SPACE=(CYL,(1,10)),UNIT=SYSDA, 
      // DCB=(RECFM=VB,LRECL=1028,BLKSIZE=6144) 
      //************************************************************ 
      //* Execute IBM IRRADU00 utility to extract RACF smf records * 
      //************************************************************* 
      //IRRADU00 EXEC PGM=IFASMFDP 
      //SYSPRINT DD SYSOUT=* 
      //ADUPRINT DD SYSOUT=* 
      //OUTDD DD DSN=&SMFOUT,SPACE=(CYL,(100,100)),DISP=(,CATLG), 
      // DCB=(RECFM=FB,LRECL=8192,BLKSIZE=40960), 
      // UNIT=SYSALLDA 
      //SMFDATA DD DISP=SHR,DSN=&SMFIN 
      //SMFOUT DD DUMMY 
      //SYSIN DD *INDD(SMFDATA,OPTIONS(DUMP)) 
      OUTDD(SMFOUT,TYPE(30:83)) ABEND(NORETRY) 
      USER2(IRRADU00) USER3(IRRADU86) /* 
      //EXTRACT EXEC PGM=QEXRACF,DYNAMNBR=10, 
      // TIME=1440 
      //*STEPLIB DD DISP=SHR,DSN=
      <the loadlib containing the QEXRACF program if not in LINKLST> 
      //SYSTSIN DD DUMMY //SYSTSPRT DD SYSOUT=* 
      //SYSPRINT DD SYSOUT=* 
      //RACIN DD DISP=SHR,DSN=&SMFOUT 
      //RACOUT DD DISP=SHR,DSN=&QRACFOUT // 
      //************************************************************* 
      //* FTP Output file from C program (Qexracf) to an FTP server * 
      //* QRadar will go to that FTP Server to get file * 
      //* Note you need to replace <user>, <password>,<serveripaddr>* 
      //* <THEIPOFTHEMAINFRAMEDEVICE> and <QEXRACFOUTDSN> * 
      //************************************************************* 
      //*FTP EXEC PGM=FTP,REGION=3800K //*INPUT DD * 
      //*<FTPSERVERIPADDR> 
      //*<USER> 
      //*<PASSWORD> 
      //*ASCII //*PUT '<QEXRACFOUTDSN>' 
      /<THEIPOFTHEMAINFRAMEDEVICE>/<QEXRACFOUTDSN> 
      //*QUIT //*OUTPUT DD SYSOUT=* 
      //*SYSPRINT DD SYSOUT=* //* //*
    8. After the output file is created, you must send this file to an FTP server.

      This action ensures that every time you run the utility, the output file is sent to a specific FTP server for processing at the end of the script. If the z/OS® platform is configured to serve files through FTP or SFTP, or allow SCP, then no interim server is needed and JSA can pull those files directly from the mainframe. If an interim FTP server is needed, JSA requires a unique IP address for each IBM® RACF® log source or they are joined as one system.

    Create an IBM RACF Log Source

    The Log File protocol allows JSA to retrieve archived log files from a remote host.

    Log files are transferred, one at a time, to JSA for processing. The log file protocol can manage plain text event logs, compressed files, or archives. Archives must contain plain-text files that can be processed one line at a time. Multi-line event logs are not supported by the log file protocol. IBM®RACF® integrated with JSA, using audit scripts, writes log files to a specified directory as plain text files. JSA processes the events, which are written as one event per line in the file. JSA extracts the archive and processes the events, which are written as one event per line in the file.

    To retrieve these events, you must create a log source using the Log File protocol. JSA requires credentials to log in to the system hosting your event files and a polling interval.

    1. Click the Admin tab.
    2. Click the Log Sources icon.
    3. Click Add.
    4. In the Log Source Name field, type a name for the log source.
    5. In the Log Source Description field, type a description for the log source.
    6. From the Log Source Type list, select IBM® Resource Access Control Faclilty (RACF®).
    7. From the Protocol Configuration list, select Log File.
    8. Configure the following values:

      Table 2: IBM RACF Log File Protocol Parameters

      Parameter

      Description

      Log Source Identifier

      Type an IP address, host name, or name to identify the event source. IP addresses or host names are recommended as they allow JSA to identify a log file to a unique event source.

      For example, if your network contains multiple devices, such as multiple z/OS® images or a file repository containing all of your event logs, you should specify a name, IP address, or hostname for the image or location that uniquely identifies events for the IBM®RACF® log source. This allows events to be identified at the image or location level in your network that your users can identify.

      Service Type

      From the list, select the protocol you want to use when retrieving log files from a remote server. The default is SFTP.

      • SFTP SSH File Transfer Protocol

      • FTP File Transfer Protocol

      • SCP Secure Copy

      The underlying protocol used to retrieve log files for the SCP and SFTP service type requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.

      Remote IP or Hostname

      Type the IP address or host name of the device storing your event log files.

      Remote Port

      Type the TCP port on the remote host that is running the selected Service Type. The valid range is 1 to 65535.

      The options include:

      • FTP TCP Port 21

      • SFTP TCP Port 22

      • SCP TCP Port 22

      If the host for your event files is using a non-standard port number for FTP, SFTP, or SCP, you must adjust the port value accordingly.

      Remote User

      Type the user name or userid necessary to log in to the host containing your event files.

      • If your log files are located on your IBM z/OS image, type the userid necessary to log in to your IBM z/OS. The userid can be up to 8 characters in length.

      • If your log files are located on a file repository, type the user name necessary to log in to the file repository. The user name can be up to 255 characters in length.

      Remote Password

      Type the password necessary to log in to the host.

      Confirm Password

      Confirm the password necessary to log in to the host.

      SSH Key File

      If you select SCP or SFTP as the Service Type, this parameter allows you to define an SSH private key file. When you provide an SSH Key File, the Remote Password field is ignored.

      Remote Directory

      Type the directory location on the remote host from which the files are retrieved, relative to the user account you are using to log in.

      For FTP only. If your log files reside in the remote userâ€s home directory, you can leave the remote directory blank. This is to support operating systems where a change in the working directory (CWD) command is restricted.

      Recursive

      Select this check box if you want the file pattern to search sub folders in the remote directory. By default, the check box is clear.

      The Recursive option is ignored if you configure SCP as the Service Type.

      FTP File Pattern

      If you select SFTP or FTP as the Service Type, this option allows you to configure the regular expression (regex) required to filter the list of files specified in the Remote Directory. All matching files are included in the processing.

      The FTP file pattern you specify must match the name you assigned to your event files. For example, to collect files starting with zOS and ending with .gz, type the following:

      Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

      FTP Transfer Mode

      This option only displays if you select FTP as the Service Type.

      From the list, select the transfer mode you want to apply to this log source:

      • Binary Select Binary for log sources that require binary data files or compressed zip, gzip, tar, or tar+gzip archive files.

      • ASCII Select ASCII for log sources that require an ASCII FTP file transfer.

      SCP Remote File

      If you select SCP as the Service Type you must type the file name of the remote file.

      Start Time

      Type the time of day you want the processing to begin. For example, type 00:00 to schedule the Log File protocol to collect event files at midnight.

      This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files. Type the start time, based on a 24 hour clock, in the following format: HH:MM.

      Recurrence

      Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D).

      For example, type 2H if you want the remote directory to be scanned every 2 hours from the start time. The default is 1H.

      Run On Save

      Select this check box if you want the log file protocol to run immediately after you click Save.

      After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule.

      Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File parameter.

      EPS Throttle

      Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 to 5000.

      Processor

      None.

      Ignore Previously Processed File(s)

      Select this check box to track and ignore files that have already been processed by the log file protocol.

      JSA examines the log files in the remote directory to determine if a file has been previously processed by the log file protocol. If a previously processed file is detected, the log file protocol does not download the file for processing. All files that have not been previously processed are downloaded.

      This option only applies to FTP and SFTP Service Types.

      Change Local Directory?

      Select this check box to define a local directory on your JSA system for storing downloaded files during processing.

      We recommend that you leave this check box clear. When this check box is selected, the Local Directory field is displayed, which allows you to configure the local directory to use for storing files.

      Event Generator

      From the Event Generator list, select LineByLine.

      The Event Generator applies additional processing to the retrieved event files. Each line of the file is a single event. For example, if a file has 10 lines of text, 10 separate events are created.

    9. Click Save.
    10. On the Admin tab, click Deploy Changes.

      The IBM®RACF® configuration is complete. If your IBM®RACF® requires custom event properties, see the JSA Custom Event Properties for IBM z™OS technical note.

    Modified: 2017-09-13