What is the difference between Compliance Event Manager PDS Monitor -vs- Event based object access of a PDS?

Products

• Compliance Event Manager

Issue/Introduction

What is the difference between Compliance Event Manager PDS Monitor -vs- Event based object access of a PDS?

Environment

Release:
Component: CEVM

Resolution

PDS Monitor Access(Monitor Component) 

The z/os Monitor is a time driven monitor. There is a parm in the parms Z/OSINTERVAL= that controls when Compliance Event Manager checks to see if there are any changes in the z/os environment. These events are not triggered by something a user did. 

At the specified time interval, z/OS Monitor collects the current z/OS configuration controls data and compares it to previous z/OS configuration controls data. If z/OS monitor detects any changes, it creates change history ("deltas") in the Monitor repository for the selected updated z/OS configuration controls.

Compliance Event Manager is not monitoring the actual logonid, date, time and command that caused the change to the monitored event. Compliance Event Manager is detecting that there has been a change in the z/OS configuration controls data. If z/OS monitor detects any changes, it creates change history ("deltas") in the Monitor repository and reports on that change. The logonid, time and command that performed the change is not available when the change is detected. The Date(%DATE%) and Time(%TIME%) for the monitored event is the date and time the event was triggered based on the time interval(Z/OSINTERVAL=).

Event Information(for PDS Access) 

User ID, ESM, Job Name, DSN, Member, Change Type, SYSID, SYSPLEX,  System Date, UTC Date, and Change Delta Old Rec# / New Rec#. 

Object Access Event(Alert Component)

The Alert component generates an external alert when a security event such as access to a PDS, FILE or system dataset is detected. Alert processing provides the opportunity to react in real time to critical events or circumstances.

Event Information 

Access, Category, Class, Date, DATE_UTC, Entity, ESM, Event, Jobname, Length, Policy Class, Policy Entity, Policy UUID, Privilege, Program, Reason, Record Length, Source, SYSID, SYSPLEX, Time, Userid, Version, Volume