Overview
| Info |
|---|
ACF2 (Access Control Facility) is an access control security system for MVS, z/OS, VSE, z/VSE, VM and z/VM IBM mainframe operating systems. |
Snare Central is able to collect ACF2 processed reports, via FTP transfer. The processed reports need to be transferred to a particular directory on the Snare Central server (/data/SnareCollect/ACF2Log). The reports will then be analysed and process by a scheduled Snare Central processes, on a daily basis.
The ACF2 processed reports are generated by specific utilities, provided with ACF2. The utilities produce formatted reports on the following activity on a mainframe:
ACFRPTLL - Logonid Modification Log
ACFRPTRL - Dataset Rule Modification Log
ACFRPTEL - Infostorate Modification Log
ACFRPTDS - Dataset Violation/Logging
ACFRPTRV - Resource Violation/Logging
ACFRPTPW - Invalid Password Authority Log
The NOTES section below contains a listing of an example JCL job which could be used to run, extract and send the ACF2 processed reports to Snare Central. This sample job has been set up for the Logonid Modification Log report, but could easily be configured for all the reports listed above. Note that a fixed transfer library name is used because a reference to this library is stored in an FTP parm library which cannot be changed with each run. Some of the programs used in this job are defined below.
Note: Newlines in the original report are transformed to 'carriage returns' (\r) in the data section of the event.
...
DATE
...
TIME
...
SYSTEM
...
TABLE
...
USERNAME
...
RESOURCE
...
LOGTYPE
...
EVENTID
...
RETURN
...
DATA
...
2017-08-07
...
10:46:08
...
DEVT
...
ACF2Log
...
ZXXX
...
APP
...
ACFRPTRL
...
BFORREPL
...
STORED
...
Check Point Anti-Malware is a component on Endpoint Security Windows Clients that protects clients from viruses, worms, Trojans, adwares and keyloggers. |
The CheckPointAntiMalwareLog module identifies and parses logs ingested from Check Point Anti-Malware.
Sample Logs
2022-06-06 10:13:01 hostname 1XX.XXX.XXX.XXX CEF:0|Check Point|Anti Malware|Check Point|Log|Log|High|cp_severity=High deviceDirection=0 msg=Error occurred while accessing:www.example.com rt=1654481578000 alert=alert ifname=daemon loguid={0x629d62ac,0x1e,0x8a5a11ac,0x36886ca} origin=1XX.XXX.XXX.XXX sequencenum=26 version=5 product=Anti Malware reason=Failed to fetch Check Point resources. Couldn't resolve host name, check /opt/CPsuite-R81/fw1/log/rad_events/Errors/flow_140125_45982949 For more details
2022-06-06 10:10:37 hostname 1XX.XXX.XXX.XXX CEF:0|Check Point|Anti Malware|Check Point|Log|Log|Very-High|cp_severity=Very-High cs2Label=Update Status deviceCustomDate2Label=Subscription Expiration deviceCustomDate2= deviceDirection=1 rt=1654481436000 loguid={0x629d621d,0xd,0x8a5a11ac,0x36886ca} origin=1XX.XXX.XXX.XXX originsicname=CN=aaaaa,O=aaaaa..aaaaaa sequencenum=18 version=5 contract_name=Anti Bot Basic Metadata log_id=4 product=Anti Malware special_properties=0 subscription_stat=expired subscription_stat_desc=Contract is expired.
Fields
Field | Description |
|---|---|
DATE | Event date, in the format YYYY-MM-DD |
TIME | Event time, in the format HH:MM:SS |
SYSTEM | The source system |
TABLE |
CheckPointAntiMalwareLog |
USERNAME
The user that ran the job
RESOURCE
The resource associated with the event
LOGTYPE
One of either:
RPTLL
RPTRL
RPTDS
RPTEL
RPTRV
Access
RPTPW
EVENTID
“ACCESS” in the case of RPTDS reports
Column 76 onward, in RPTRV reports
RETURN
RPTDS: Columns 38 - 48
RPTRV: Columns 50-55
DATA
A range of carriage-return delimited data that is not specifically injected into other fields.
Notes
The sample job below performs the following steps:
Deletes previous day's FTP transfer library.
Runs ACF2 report, placing output in a GDG (7 generations kept).
Allocate new FTP transfer library and copy report from GDG created in previous step.
FTP the transfer library to Snare Central.
The 'snarexfer' FTP user must be used.
This user's home directory defaults to "
/data/SnareCollect" on the Snare Central server.The ACF2 processed reports must be placed in the "ACF2Log" sub-directory ("
/data/SnareCollect/ACF2Log").Member level security is used to protect the FTP lid password.
The IEBGENER program used in the sample job is an IBM-supplied utility program designed to generate copies of data sets when disk storage or tape is involved.
The IKJEFT01 program is the TSO/E program, and is used to perform a TSO function within a batch job.
SEVERITY | Event severity |
ORIGIN | Name of the first Security Gateway that reported this event |
MESSAGE | Event Message |
SNAREDATAMAP | Data that were not mapped to any of the above fields are pushed here. |
Notes
The ORIGIN field is derived from origin or originsicname. CN value of originsicname will be used first. If originsicname is not available, origin will be used.
The MESSAGE field is derived from either msg or subscription_stat_desc values.
All other fields are appended in SNAREDATAMAP field.
References:
https://community.checkpoint.com/t5/Management/Log-Exporter-CEF-Field-Mappings/m-p/41060