There is a need to monitor IND$FILE. Is it possible for CEM to generate an alert when IND$FILE (a member of SYS1.CMDLIB) is accessed for execution?
Release : 6.0
Component : CA COMPLIANCE EVENT MANAGER
To facilitate this in CEM (Compliance Event manager), an Event based Object Access (select Object Access Successful No Audit and Object Access Audit) policy statement can be created with a Test Condition for PROGRAM=IND$FILE. Or, if the need to capture someone copying the data by other means include (eg. IEBCOPY and FTPDNS.) Also, if you want to limit this to certain datasets or high level qualifier a DSNLIST can be setup.
Example of test condition:
PROGRAM="IEBCOPY" OR PROGRAM="IND$FILE" OR PROGRAM="FTPDNS"