Using CEM, is it possible to send an alert when IND$FILE is accessed?

Products

• Compliance Event Manager

Issue/Introduction

There is a need to monitor IND$FILE.  Is it possible for CEM to generate an alert when IND$FILE (a member of SYS1.CMDLIB) is accessed for execution?
 

Environment

Release : 6.0

Component : CA COMPLIANCE EVENT MANAGER

Resolution

To facilitate this in CEM (Compliance Event manager), an Event based Object Access (select Object Access Successful No Audit and Object Access Audit) policy statement can be created with a Test Condition for PROGRAM=IND$FILE.  Or, if the need to capture someone copying the data by other means include (eg. IEBCOPY and FTPDNS.)  Also,  if you want to limit this to certain datasets or high level qualifier a DSNLIST can be setup.

Example of test condition:
PROGRAM="IEBCOPY" OR PROGRAM="IND$FILE" OR PROGRAM="FTPDNS"