Jim McNeill. Vanguard Professional Services VSS10 & VSS13

Transcription

1 Jim McNeill Vanguard Professional Services VSS10 & VSS13 1

2 2 Legal Notice Copyright 2017 Copyright by Vanguard Integrity Professionals, Inc. All rights reserved. Unauthorized reproduction, modification, publication, display, or distribution of this work in any form is not permitted. Criminal copyright infringement may be punishable by fines and/or incarceration. Recording of live or online presentations is not permitted. The use of session, event, staff, or presenter images is not authorized including but not limited to posting images on social media. With respect to presentation materials such as hand-outs or slide decks, registered participants are permitted to reproduce, distribute, and display such materials internally within their organizations for non-commercial educational purposes only. All other uses must be expressly granted in writing by Vanguard Integrity Professionals, Inc.. Trademarks The following are trademarks of Vanguard Integrity Professionals Nevada: Vanguard Administrator Vanguard Advisor Vanguard Analyzer Vanguard SecurityCenter Vanguard Offline Vanguard Cleanup Vanguard PasswordReset Vanguard Authenticator Vanguard incompliance Vanguard IAM Vanguard GRC Vanguard QuickGen Vanguard Active Alerts Vanguard Configuration Manager Vanguard Configuration Manager Enterprise Edition Vanguard Policy Manager Vanguard Enforcer Vanguard ez/token Vanguard Tokenless Authenticator Vanguard ez/piv Card Authenticator Vanguard ez/integrator Vanguard ez/signon Vanguard ez/password Synchronization Vanguard Security Solutions Vanguard Security & Compliance Vanguard zsecurity University

3 3 Trademarks The following are trademarks or registered trademarks of the International Business Machines Corporation: CICS CICSPlex DB2 eserver IBM IBM z IBM z Systems IBM z13 IMS MQSeries MVS NetView OS/390 Parallel Sysplex RACF RMF S/390 System z System z9 System z10 System/390 VTAM WebSphere z Systems z9 z10 z13 z/architecture z/os z/vm zenterprise Java and all Java-based trademarks are trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group in the United States and other countries. Microsoft, Windows and Windows NT are registered trademarks of Microsoft Corporation. Other company, product, and service names may be trademarks or service marks of others.

4 4 Session Topics Vanguard Advisor Functions Vanguard Advisor Standard Reports Online Vanguard Advisor Navigation Replacing the RACF Report Writer Beyond Security Event Reporting

5 5 Vanguard Advisor Functions Extensive Data Mining Capabilities Summary and Detail Reports Ability to drill down from Summary Reports to Detail Reports Exception Criteria Filters Masking Filters Enhanced Masking Filters Online TSO/ISPF and Batch Operation Same Online look and feel as Vanguard s Administrator Batch JCL and Control Statements generated from Online panels

6 6 Vanguard Advisor Functions Processes Live, Extract, or Historical SMF Data Any Online SMF Data Set (Includes LOGSTREAM) Vanguard Extract Data Set Multiple Input Files for Batch Reports Extract VSAM files (VSRVnn DDname ) Historical SMF Data Sets (VSRD DDname) Live MAN datasets (VSRS DDname) Logstreams (VSRL DD DUMMY) IDCAMS Repro of extracts (VSRR Ddname) SMF Data from Multiple SMF IDs Extract File Selection From the Main Menu Filtered Catalog Search for Extract Data Sets Vanguard Extract File Merge Utility SMF

7 7 Vanguard Advisor Functions Ad Hoc Reporting Capabilities Reports generated into sequential data sets User selected report fields User selected report format User defined report titles PRNTF Command from Detail Reports QuickGen Reports

8 VSS Main Menu 8

9 Advisor Main Menu 9

10 Advisor Standard Reports 10

11 Advisor Special Reports 11

12 Advisor General Summary Reports 12

13 Data Services 13

14 14 Online Advisor Navigation Selecting an Advisor input data set Extract or Live Data Selection of Report Filtering Options Exception Criteria Masking Fields Enhanced Masking Selection

15 Special Processing Options 15

16 16 Selecting an Input Data Set Blank out

17 Selecting an Input Data Set 17

18 Selecting an Input Data Set 18

19 19 Online Advisor Navigation Selecting an Advisor input data set Extract or Live Data Selection of Report Filtering Options Exception Criteria Masking Fields Enhanced Masking Selection

20 20 Live SMF Data or Extract EXTRACT SMF LIVE Extract Vanguard Advisor gives you a choice.

21 Extract or Live Data 21

22 Extract or Live Data 22

23 Extract or Live Data 23

24 Extract or Live Data 24

25 25 Online Advisor Navigation Extract or Live Data Selection of Report Filtering Options Exception Criteria Masking Fields Enhanced Masking Selection

26 Exception Criteria 26

27 27 Standard Masking Fields PF1

28 Event Name and Codes 28

29 Event Name and Codes 29

30 Event Name and Codes 30

31 Event Name and Codes 31

32 Standard Masking Fields 32

33 Enhanced Masking 33

34 Enhanced Masking 34

35 35 Online Advisor Navigation From Online Summary Reports SORT, LOCATE, PRNT,QUICKGEN Drill Down to Detail Report From Online Detail Reports SORT, LOCATE, PRNT, PRNTF, ,QUICKGEN Real Time Update of RACF Resource Profile Accesses Access to Administrator Vanguard RACF Commands component Display Additional SMF Record Data (drilldown)

36 Online Summary Report Commands 36

37 Online Summary Report Commands 37

38 Locate 38

39 Locate Results 39

40 Sort 40

41 Sort Results 41

42 Sort List 42

43 Sort List 43

44 Sort List Results 44

45 PRNT 45

46 PRNT 46

47 47

48 48

49 49

50 50

51 51

52 52 Press F3

53 53

54 Drill Down to Detail 54

55 Drill Down to Detail 55

56 56 Online Advisor Navigation From Online Summary Reports SORT, LOCATE, PRNT,QUICKGEN Drill Down to Detail Report From Online Detail Reports SORT, LOCATE, PRNT, PRNTF, ,QUICKGEN Real Time Update of RACF Resource Profile Accesses Access to Administrator Vanguard RACF Commands component Display Additional SMF Record Data (drilldown)

57 PRNTF 57

58 PRNTF 58

59 PRNTF 59

60 PRNTF 60

61 PRNTF - Output 61

62 62 Vanguard QuickGen Access Warn due to Protectall

63 QuickGen 63

64 QuickGen 64

65 QuickGen 65

66 QuickGen 66

67 QuickGen 67

68 QuickGen 68

69 69 QuickGen QUIZ: What s wrong with these commands?

70 QuickGen 70

71 71 Online Advisor Navigation From Online Summary Reports SORT, LOCATE, PRNT,QUICKGEN Drill Down to Detail Report From Online Detail Reports SORT, LOCATE, PRNT, PRNTF, ,QUICKGEN Real Time Update of RACF Resource Profiles Access to Vanguard RACF Commands component Display Additional SMF Record Data (drilldown)

72 R Line Command 72

73 Updating Access List 73

74 Executing Generated Commands 74

75 75 Online Advisor Navigation From Online Summary Reports SORT, LOCATE, PRNT,QUICKGEN Drill Down to Detail Report From Online Detail Reports SORT, LOCATE, PRNT, PRNTF, ,QUICKGEN Real Time Update of RACF Resource Profiles Access to Vanguard RACF Commands component Display Additional SMF Record Data (drilldown)

76 VRC Line Command 76

77 VRC Line Command 77

78 VRC Line Command 78

79 VRC Line Command 79

80 80 Online Advisor Navigation From Online Summary Reports SORT, LOCATE, PRNT,QUICKGEN Drill Down to Detail Report From Online Detail Reports SORT, LOCATE, PRNT, PRNTF, ,QUICKGEN Real Time Update of RACF Resource Profile Accesses Access to Administrator Vanguard RACF Commands component Display Additional SMF Record Data (drilldown)

81 Detailed Drilldown 81

82 Detailed Drilldown 82

83 83 Replacing the RACF Report Writer LOGON Violations System Entry Report with Selection Criteria Resource Access Violations Resource Access Report with Selection Criteria RACF Command Violations RACF Command Report with Selection Criteria

84 Logon Violations Report 84

85 Logon Violations Report 85

86 Logon Violations Report 86

87 Logon Violations Report 87

88 Logon Violations Report 88

89 Logon Violations Report 89

90 Logon Violations Report 90

91 Logon Violations Report 91

92 92 Replacing the RACF Report Writer LOGON Violations System Entry Report with Selection Criteria Resource Access Violations Resource Access Report with Selection Criteria RACF Command Violations RACF Command Report with Selection Criteria

93 Resource Access Violations 93

94 Resource Access Violations 94

95 Resource Access Violations 95

96 Resource Access Violations 96

97 97 Replacing the RACF Report Writer LOGON Violations System Entry Report with Selection Criteria Resource Access Violations Resource Access Report with Selection Criteria RACF Command Violations RACF Command Report with Selection Criteria

98 RACF Command Violations 98

99 RACF Command Violations 99

100 RACF Command Violations 100

101 RACF Command Violations 101

102 RACF Command Violations 102

103 RACF Command Violations 103

104 104 Replacing the RACF Report Writer WARNINGS Resource Access Report with Masking Event Name Code 02 Event Qual Code 03 OPERATIONS Attribute Data Set Access Report with Masking Log Reason - OPR UAUDIT Attribute User Activity Report with Masking Log Reason - UAD

105 105 Replacing the RACF Report Writer Undefined User/Job/STC System Entry Report with Masking Event Name Code 01 Event Qual Code 09 SPECIAL Attribute RACF Commands Report with Masking Log Reason - SAD

106 106 Replacing the RACF Report Writer Transition to Summary Reporting Start with Summary Reports Drill Down for Unusual Situations

107 107 Beyond Security Event Reporting RACF Administration Batch Utilities RACF Command Extractor RACF Remove OPERATIONS Utility

108 RACF Command Extractor 108

109 RACF Command Extractor 109

110 Specify Command Data Set 110

111 Specify Masking Criteria 111

112 Submit the Job 112

113 Review the Output 113

114 114 Beyond Security Event Reporting RACF Administration Batch Utilities RACF Command Extractor RACF Remove OPERATIONS Utility

115 Remove Operations 115

116 Specify Command Data Set 116

117 Submit the Job 117

118 118 Remove Operations Use caution!!

119 119 Beyond Security Event Reporting Violation Notices via Sent from Online TSO/ISPF Sent from Batch Jobs One, multiple, or lists of addresses Active Alerts Sent via when specific events occur Report Distribution via Sent from Online TSO/ISPF Sent from Batch Jobs One, multiple, or lists of addresses

120 120 Beyond Security Event Reporting Real Time Notification via - Active Alerts Violation notices User given System-SPECIAL, OPERATIONS, AUDITOR or OMVS UID(0) User connected with Group-SPECIAL, Group-OPERATIONS, Group-AUDITOR Attribute or CREATE, CONNECT, or JOIN Authority Data Set Profile UACC > READ Data Set Profile UACC > NONE Access Allowed due to WARNING

121 121 Beyond Security Event Reporting Real Time Notification via - Active Alerts Intrusion detection - multiple failed passwords for a user Password recycling - only when changed by command SETROPTS CLASSACT or NOCLASSACT SMF lost data User revoked because of incorrect passwords Task Initiation by a specific User (Firecall or Emergency IDs) Access to specified resources Multiple Addressees One or more address Distribution list

122 122 Questions How to Contact Us Vanguard Integrity Professionals 6625 South Eastern Ave., Suite 100 Las Vegas, NV Direct/International: (702) Toll Free: (877)

123 123 Session Evaluation Be sure to rate your experience in the Guidebook app guidebook Using the built-in star rating system, and evaluation forms, you ll be able to share your feedback on sessions and speakers. Your opinions help us to bring you the best possible conference experience. Please let us know your thoughts.