Global Security Forum

Hi how can I create an Alert under ZALERT that reads and verifies the logon of a series of users defined in a racf group?? I can't with any of the Alerts available on zalert Thanks for your collaboration Maurizio

Hi Maurizio,

There is a forum specifically for security on Z, including zSecure here.

The easiest way to create a new alert is to find a similar alert, copy the alert definition with a C line command, and edit the alert skeleton from the SE.A.A dialog.

Alerting on the use of a specific user ID is done with alert 1102 
This uses a panel to query the user IDs, and fills those users into a select statement with 

USER=(,
id,
id,
)

If you modify the skeleton to reference field USER_GROUPS, it allows you to select events based on the groups that the user is connected to, e.g.

USER_GROUPS=(,
SYS*,
DBA,
DBMAINT,
)

You could reuse the ISPF panel from alert 1101 to fill in the group names from the dialog.

Also, if you only wanted to monitor a small number of groups (in a BIG RACF database), you could use the PRIV_USER_GROUPS field, and specifically define the groups to be monitored using the SIMULATE PRIV_USER_GROUPS command.

------------------------------
Rob van Hoboken
------------------------------

No problem, a question not asked is an opportunity lost ;-)

You copy an alert by using the C line command in the SE.A.A alert selection list.  See alert manual.  Next you select "View/edit alert skeleton" to edit the skeleton.

For more details about the alert skeleton see here.

------------------------------
Rob van Hoboken
------------------------------

Alert 1701 should react when a CONNECT command is issued with a group name that is in the list of important groups.

First you should verify if an SMF record was generated for the CONNECT command.  You could use EV.G to process the SMF records from your system.

If you find the SMF record, you have to check if the alert was correctly configured, and active at the time when the CONNECT command was issued.

------------------------------
Rob van Hoboken
------------------------------