ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Using CEM, is it possible to send an alert when IND$FILE is accessed?

book

Article ID: 199080

calendar_today

Updated On:

Products

Compliance Event Manager

Issue/Introduction

There is a need to monitor IND$FILE.  Is it possible for CEM to generate an alert when IND$FILE (a member of SYS1.CMDLIB) is accessed for execution?
 

Environment

Release : 6.0

Component : CA COMPLIANCE EVENT MANAGER

Resolution

To facilitate this in CEM (Compliance Event manager), an Event based Object Access (select Object Access Successful No Audit and Object Access Audit) policy statement can be created with a Test Condition for PROGRAM=IND$FILE.  Or, if the need to capture someone copying the data by other means include (eg. IEBCOPY and FTPDNS.)  Also,  if you want to limit this to certain datasets or high level qualifier a DSNLIST can be setup.


Example of test condition:
PROGRAM="IEBCOPY" OR PROGRAM="IND$FILE" OR PROGRAM="FTPDNS"