IBM Security Z Security

 View Only
  • 1.  TYPE=ACCESS Summary report using SIM_VIA_GROUPS

    Posted Mon August 08, 2022 01:29 PM
    I have a set of CARLA code attached where I am using TYPE=ACCESS and SIM_VIA_GROUPS to show access usage to a set of Dataset profiles, but I want to show how the user accessed the datasets   So I have the summary report running, but I would like for the 1st column sim_via_groups to be repeated on each line.    I added  RETAIN to my NEWLIST statement, but that did not seem to help in this summary report.      I realize my spacing is a little off on my detailed print line.

    Most of my attempts to print sim_via_groups on each line result in issues about compound summary keys and repeat group values.

    I tried using SORTLIST but then I lose the access count, and the ability to show 1st and last occurrence.

    ------------------------------
    Linnea Sullivan
    ------------------------------

    Attachment(s)

    TXT
    REPORT.TXT   9 KB 1 version
    TXT
    CARLA.TXT   1 KB 1 version


  • 2.  RE: TYPE=ACCESS Summary report using SIM_VIA_GROUPS

    IBM Champion
    Posted Tue August 09, 2022 04:06 AM
    Edited by Rob van Hoboken Tue August 09, 2022 04:14 AM
    SIM_VIA_GROUPS is a repeat field, that is, a multi-value field showing one or more groups that allowed access (because you selected only the SIM_VIA=ID_GROUP observations).

    SUMMARY SIM_VIA_GROUPS creates a summary level for each unique value found in (any of the values of) SIM_VIA_GROUPS.  So, if a user had 3 theoretical access paths to a data set, the user ID pops up in 3 SIM_VIA_GROUPS summary buckets.

    Let me see if I understand your requirement.  You need a report with all relevant user IDs, and for each user/dsname combination show 1 line with the group(s) that allowed access?  This is possible when you change the SIM_VIA_GROUPS field from a normal data field into one or more statistics.  This is doable, provided you know the universe of applicable group names in advance.

    define grp1(8,hdr$blank,'RADMIAM1') boolean where sim_via_groups=RADMIAM1
    define grp2(8,hdr$blank,'RADMIAM2') boolean where sim_via_groups=RADMIAM2
    define grp3(8,hdr$blank,'RADMINQ ') boolean where sim_via_groups=RADMINQ

    select,
    sim_via="ID_GROUP",resource=:(prdsa,prdds,syssa),class=dataset,
    rectype=(auth,fast,def) req_status_access<>yes,access_result=("00"x)
    summary,
    userid(nd),
    grp1 grp2 grp3,
    userid, userid:name class(8), resource(70), access_profile(44), intent(9),
    last_tod_sum, tot_count, complex
    Obviously, this requires some preparation, but is related the multi-value nature of SIM_VIA_GROUPS and the purpose of SUMMARY processing.

    An alternative approach would pivot on having SIM_VIA_GROUPS processed as a single-value field, which can be done with a two-step process.
    Step 1 will use SORTLIST to write out each field combination (without counts, etc) into a flat file.
    Step 2 reads the groups names into a single field, same as the user ID, name, etc. using SUBSTR(RECORD,start,length), and then uses SUMMARY.
    You would have to use a DEFINE xx AS CONVERT( ) to change character fields into integers, to do counting, but you might get your results.

    ------------------------------
    Rob van Hoboken
    ------------------------------


  • 3.  RE: TYPE=ACCESS Summary report using SIM_VIA_GROUPS

    Posted Wed January 04, 2023 08:18 PM
    That's interesting as I had the same issue and had to use SORTLIST (without the count) too.
    I'm also wondering the purpose of the below select filter. Does that mean that you only want to list the access done via groups and not other access?
    select,                                                                         
    sim_via="ID_GROUP"


    ------------------------------
    Bruno Charon
    ------------------------------



  • 4.  RE: TYPE=ACCESS Summary report using SIM_VIA_GROUPS

    Posted Thu January 05, 2023 12:54 AM
    Hi Bruno,

    Indeed ID_GROUP indicates that the type of authorization used to grant the access was a group. The help panel text for the value is

    ID_GROUP     Access simulation against the current RACF database exploited  
                 a group permit. The SIM_VIA_GROUPS field lists the groups      
                 that all grant the access level needed.                        
    ​

    Regards,

    Jeroen

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------