Exporting IBM i Data to Syslog

(1)

www.safestone.com

Exporting IBM i

Data to Syslog

(2)

1

Overview

Exporting security information from IBM i to other platforms can be challenging, particularly to enterprise-class security consoles. A few of the issues that are encountered include capturing data in real-time on IBM i, filtering the events, and formatting the data for the console on the remote platform.

Safestone Technologies developed iConnect to meet these challenges and extend SIEM consoles to incorporate IBM i security events. The IBM i (i5/OS) generates an immense amount of security data in its logs and journals. iConnect monitors, captures, filters and formats this data into relevant security event messages and transfers them to syslog console for subsequent correlation and aggregation.

iConnect captures over 300 different events, including: -  Network Access

 Object Changes  User Profile Details  System Journal Entries  SQL commands

 System History Log Entries

The events can be sent from your IBM i on a schedule that you determine, and can be reported on as often as every minute to once a day, depending on individual requirements.

iConnect is preconfigured with a wide selection of security events, and it is also extensible. If you want to add IBM i events that are not preconfigured, or even your own application events, iConnect is able to support this.

Safestone

Safestone has been providing IBM i security solutions for 25 years. DetectIT is the security suite of products that customers use to secure their systems; iConnect is included in the suite.

SIEM consoles

(4)

3

Parts and Pieces

A number of components make up the environment that captures and moves the events to the console. Once they have been broken down to their component parts, it is easier to understand what is captured, and what architecture is required to move the events from IBM i.

DetectIT is an IBM i application. It is a suite of modules designed to convert raw i5/OS security events into relevant security information. It was originally designed to create audit reports to document compliance for internal and external auditors, but was architected such that it was easy to capture security events for other purposes. iConnect uses several of these modules, including Security Audit and Detection and Network Traffic Controller to capture the events you want to see.

The following section explains some details of these modules and what they do: -

 The Security Audit and Detection module is designed to capture system audit journal (QAUDJRN) events, and history log (QHST) activity. Events from these two sources make up the majority of security events that administrators and auditors will want to see. Security Audit and Detection includes filtering to select specific QAUDJRN events, so you don’t have to collect everything. This flexibility is essential for minimizing performance issues and to reducing data collection that doesn’t provide security value.

 The Network Traffic Controller module uses the IBM TCP/IP and Host Server exit points to capture network traffic. Remote connections like FTP or ODBC (Object DataBase Connectivity) can be monitored at a granular level including the user, source and destination IP addresses, and the details of the activity itself. This information can’t be captured natively in i5/OS; only the exit points can allow you to see it. There is filtering available in Network Traffic Controller too, so that repetitive traffic that isn’t important can be excluded.

Both modules collect the data into a repository, and also support sending the events to external sources like message queues, and syslog. Sending events to syslog is what makes DetectIT so powerful and flexible, since all SIEM consoles understand this protocol. IBM i supports syslog natively in the PASE environment and DetectIT includes a syslog daemon to write the events to it. iConnect uses the remote syslog function to export the events from syslog on IBM i to syslog referenced by an SIEM console.

Putting it all Together

(5)

4 The diagram below illustrates how the process works.

Conclusion

(6)

5

About Safestone

Safestone is the leading supplier of security, audit and compliance solutions for IBM Power Systems (i, AIX, Linux). Their module-based solutions are flexible, scalable, easy to implement and use and they address all varying degrees of audit, compliance and security requirements.

An Advanced IBM Business Partner and long-standing member of the IBM i ISV Advisory Council, Safestone helps businesses meet compliance regulations (Sarbanes-Oxley, PCI DSS, Basel II, HIPAA) and information.

Partner of choice for global financial and banking institutions with the most stringent security and compliance requirements, Safestone provides the most comprehensive solution in System i security to over 500 blue-chip customers worldwide.

Their global network, developed over more than 25 years provides localized sales, consultancy and professional services to help organizations manage all their System i security requirements.

Safestone’s Solutions for Audit and Compliance

Security Audit and Detection – comprehensive real time intrusion detection and alerting allowing pro-active management of security events and potential breaches.

Risk & Compliance Monitor – identifies policy compliance vulnerabilities by reporting against off-the-shelf policies (Sarbanes-Oxley, PCI DSS, Basel II, ISO 27002, etc.), and in so doing helping to prepare organizations for audit.

Powerful User Passport – enables system administrators to limit the number of powerful users. It provides auditors and management a comprehensive audit trail of user activities.

DetectIT Password Self-Help – enables users to reset their own passwords on System i immediately, without needing to call the Help Desk and wait for the request to be processed. The user is presented with a series of challenge-response questions to validate their authenticity. If approved, the password reset is made instantly. Compliance Center – is a powerful and flexible query-based reporting solution that simplifies the task of collecting and converting a vast array of audit, compliance and security events into compliance reports. Reports can be scheduled and automated with easy-to-read graphics.

User Profile Manager – provides full identity management systems across multiple System i machines / partitions.

For more information please contact: -

[email protected]