WTO or email variables to track ACF2 rule that allowed access to Object Access Successful No Audit event

Products

• Compliance Manager for z/OS

Issue/Introduction

Are there WTO or email variables that can be used in ACF2 to track the rule that allowed access to Object Access Successful No Audit event?

Resolution

With ACF2, the ENTITY, RULEKEY and RULELINE variables can be used in a WTO or EMAIL Action for Object Access Successful No Audit events to return the dataset or resource(ENTITY), the $KEY (RULEKEY) and the ACF2 rule entry(RULELINE) that allowed access to the object.

The variables are enclosed in '%' and expanded in when the event ALERT WTO is triggered.

For example the following WTO text is defined for a WTO Action attached to an Alert Object Access Successful No Audit event Policy statement, WTO Text:

Event: %EVENT% Entity: %ENTITY% Jobname: %JOBNAME%
Category: %CATEGORY%
Access: %ACCESS% Rulekey: %RULEKEY%
RuleLine: %RULELINE%

OBJECTACCESS event triggered, WTO on SYSLOG:

Event: OBJECTACCESS Entity: SYS1.BRODCAST Jobname: USER002 809
Category: OBJECTACCESS
Access: READ Rulekey: SYS1
RuleLine: - UID(*) READ(A) EXEC(A)