IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Timestamp in Compliance report (from CKFREEZE creation date)

    Posted Wed April 05, 2023 03:01 PM

    Dear,

    We are building a compliance output readable for management/audit, but we would like to have a column with timestamp on each compliance rule set with the date when the test ran (or when the CKFREEZE file was created). The red part is wrong, but I guess it is somewhere there I need to add it, but can't figure it out.
    Could someone please advice? 
    Thanks in advance!


    n type=compliance_rule_set name=LSTRULES required ,             
      tt='C O M P L I A N C E   R U L E   S E T   S U M M A R Y'    
      define tribe("Tribe",str$blank("xxxx "),18) true 
      define team("Team",str$blank("yyyy "),9) true             
      define time("Timestamp",?CKFREEZE creation date?,11) true                        
                                                                    
     sortlist rule_set_sortkey(nd,key),                             
             rule_set(key,pas,13) standard complex,                 
             tribe team time,                                       
             test_percent_comply,                                   
             rule_set_not_applicable(hb) suppress(hb) ,             
             test_total# test_compliant# ,                          
             test_noncompliant# test_undecided# ,                   
             rule_set_desc(0,ww,'Description') ,                    
     / '                        '(ne) suppress_reason(ww)           



    ------------------------------
    Tim Osaer
    ------------------------------


  • 2.  RE: Timestamp in Compliance report (from CKFREEZE creation date)

    Posted Thu April 06, 2023 02:48 AM
    Edited by Rob van Hoboken Thu April 06, 2023 04:41 AM

    Hi Tim
    I had the same requirement when I was implementing compliance reports.  You may be able to get the date when the test was evaluated with a lookup to the RUN newlist type, like so:

    :run.datetime

    but this shows information from the (possibly random) LPAR where the CKRCARLA job is running.  Check for other fields in the RUN newlist.

    There is another newlist type RUN_DD that holds one entry for each input or output data set allocated to the job.  For UNLOAD and CKFREEZE data sets, the date, time and origin system are available, so you could create a report ahead of your compliance report that shows when and where the information was collected.

    newlist type=run_dd title="Information used in this compliance report"
      select type=(ckfreeze,unload*,racf,acf2*)
      summary complex * type system datetime vol_dsn_path count(nd)

    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 3.  RE: Timestamp in Compliance report (from CKFREEZE creation date)

    Posted Thu April 06, 2023 02:55 AM
    Edited by Jeroen Tiggelman Thu April 06, 2023 05:41 AM

    Hi Tim,

    The COMPLIANCE* report types do a kind of meta-reporting on the results of (tests implemented using) various underlying report types. The underlying report types can be based on COMPLEX, CKFREEZE, or something else. And multiple CKFREEZEs might be used in the run. Therefore, these report types do not have a field that represents the CKFREEZE timestamp.

    Furthermore, a TRUE variable without a condition is simply always true, so that is in essence a literal string rather than a particular value.

    That means that following your approach, you would really want to substitute a literal string there just like on the preceding statements: STR$BLANK("generated date"). 

    So you could devise a query that would generate this query mostly as a few literals, but substituting the CKFREEZE date.

    Since you appear to be using both single and double quotes for string literals in this query already, it would probably be easiest to use left quotes ( `) to indicate the literal parts of the first query.

    Say, something like

    newlist type=system nopage
    list `n type=compliance_rule_set name=LSTRULES required ,` /,
    `tt='C O M P L I A N C E   R U L E   S E T   S U M M A R Y' ` /,   
    `  define tribe("Tribe",str$blank("xxxx "),18) true ` /,
    `  define team("Team",str$blank("yyyy "),9) true ` /,
    `  define time("Timestamp",` | COLLECT_DATETIME | `,11) true ` / /,
    ` sortlist rule_set_sortkey(nd,key),  `/,
    ....
    etc.                           
         

    where I note:
    - TYPE=SYSTEM is a SYSTEM-based report type (where a system can be the live system or CKFREEZE-based), which therefore has a field to report the CKFREEZE timestamp, viz. COLLECT_DATETIME, which we write into the query you are generating.
    - This query will only make sense when there is only one CKFREEZE.
    - Because there should be only one CKFREEZE, there should be only one output record written.
    - As we are not doing anything fancy on that level otherwise, we don't need SORTLIST but simply can use LIST.

    If you want to use multiple CKFREEZE but generate the timestamp (randomly) from the first one, you can add OUTLIM=1 on the NEWLIST statement.
    If you'd want to do something less random in that kind of case, you could change LIST to SUMMARY and then generate a MIN or MAX summary statistic DEFINEd in terms of COLLECT_DATETIME instead.
    Or perhaps you would do a SELECT on a particular LPAR instead: SELECT SYSTEM=<main_LPAR> to ensure you'd only get one record from the LIST.

    I hope this gives you useful some ideas.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------



  • 4.  RE: Timestamp in Compliance report (from CKFREEZE creation date)

    Posted Thu April 06, 2023 05:41 AM

    I should also have put a NOPAGE keyword on the NEWLIST, to suppress all page and column headers.



    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------