IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Alert when the TCP/IP Routing table changes

    Posted 06/05/24 10:17 AM

    Hello,

    I have been asked to investigate the use of z/Secure Alert to raise an alarm when the TCP/IP routing table changes.  

    Can anyone confirm if this is possible?  Has anyone else had to implement such an alarm who is willing to share their experiences?



    ------------------------------
    Many thanks,
    Peter
    ------------------------------



  • 2.  RE: Alert when the TCP/IP Routing table changes

    Posted 06/06/24 04:34 AM

    The routing information is in newlist type=IP_ROUTE, see doc.

    zSecure Alert (note the name, no slash ;-) ) has an automated configuration collector that runs every hour, and alerts are available to compare the CKFREEZE from this collect with the previous one.  This is referred to as extended monitoring and comes with several sample alerts, including some for the IP stack such as 1615.  You could create a new alert from this model and change the newlist type.

    Note, this would tell you of configuration changes up to 1 hour after the fact, and would miss out when the change is reverted before the next collect.

    Also, you have to activate extended monitoring, see the installation manual.



    ------------------------------
    Rob van Hoboken
    ------------------------------



Related Content