IBM Security Z Security

 View Only

 zALERT for an ADDUSER

Joseph Sumi's profile image
Joseph Sumi posted Mon June 16, 2025 06:19 PM

Hello - need to create an alert when a ADDUSER is performed.

Is this possible? was looking at the canned alerts for something to use but not seeing anything. 

thanks. Joe

RENE van TIL's profile image
RENE van TIL

Hey joe,

Alert 1105 is for an ADDUSER/ALTUSER with a check on its attributes.  It serves as a start i think.

select event=(adduser(0,2),altuser(0,2)),               
       racfcmd_keywords_eff=(SPECIAL,OPERATIONS,AUDITOR,ROAUDIT,CLAUTH) 

cheers

rene

Joseph Sumi's profile image
Joseph Sumi

Thanks !!!! We have the ADDUSER alert working. Joe