Audit TM. The Security Auditing Component of. Out-of-the-Box

Transcription

1 Audit TM The Security Auditing Component of Out-of-the-Box

2 This guide is intended to provide a quick reference and tutorial to the principal features of Audit. Please refer to the User Manual for more detailed procedures and explanations. See the isecurity Installation Guide for installation procedures. Overview Audit is a security auditing solution that monitors System i events in real-time. Raz-Lee s Audit interacts with IBM system audit feature and serves as a complementary solution to the system s basic product. It collects the audited data and displays it in a user friendly log display. It includes a powerful query generator plus a large number of predefined reports. Audit can also trigger customized responses to security threats by means of the script processor integrated into Action. Use Audit to define OS/400 system values, user profile parameters and object parameters that make up the system s audit settings. If the OS/400 audit is not working and is being activated after activating real-time Audit, you will have: 1. OS/400 audit according to the selected audit level 2. Real-time Audit 3. Action based on the real time Audit 4. The disk-space consumes by both the OS/400 system journal and by real-time Audit logs Some of the Audit entries (like object auditing: ZR=read object) can influence performance and disk space. Use the Visualizer to implement by recognizing what are the largest entry types in the organization and how to minimize the performance impact. See General Settings, step 1 to learn how to define the Audit setting according to your organization s needs. Setting Initial Audit Parameters Enter 1 in the command line or type STRAUD and press Enter twice. The Audit main screen appears. Audit Main Menu 2

3 Work with Collected Data View summaries of Audit journal contents by day, showing the number of entries for each day together with the amount of disk space used. Delete individual days in order to conserve disk space. 1. Select option 82. Maintenance Menu > 51. Work with Collected Data. The Work with Collected Data screen appears. 2. Select 2 for Audit and press Enter. The Work with Collected Data Audit screen appears. Work with Collected Data 3. Select 4 to delete data from a specific date and press Enter. Audit Retention Define the length of time that audit data is retained on-line and specify a backup routine to store archived data off-line automatically when the designated retention period has expired. It is recommended to store archived data on external media, such as tape or optical media. 1. Select 9. Log & Journal Retention from the System Configuration menu. The Log & Journal Retention screen appears. 2. Enter the number of days to retain audit data online in the field provided, or type '*99' to retain audit data online indefinitely. 3. Select a back-up program to be used to store archived log data off-line. 3

4 General Settings Log & Journal Retention 1. Audit Settings refers to the parameters which determine the events to be recorded in the AS/400 security audit journal for all users on a global basis. Select option 1. OS/400 Audit Features to modify the Audit setting. OS/400 Audit Features 4

5 Modify the current audit setting manually by selecting 1. Work with Current Setting from the OS/400 Audit Features screen. Type a Y in the Activate column for each parameter you wish to enable. Work with Current Setting Modify or create a pre-defined setting by selecting 2. Work with Pre-Defined Settings from the OS/400 Audit Features menu. Activate a pre-defined setting by selecting 3 from the OS/400 Audit Features menu and choosing a pre-defined setting from the list. Use the Audit Scheduler to activate pre-defined settings automatically at specific times by selecting 11 from the OS/400 Audit Features menu. 2. Activate real-time detection by selecting 2. Activate Real-Time Detection from the main menu. 5

6 Activation Menu 3. Rules identify which specific events trigger actions and under what conditions the response should occur. Define real-time detection rules by selecting 11. Real-Time Auditing from the main menu; then select a rule from the list or press F6 to create a new rule. Work with Real-Time Auditing 4. Actions define specific responsive actions that take place whenever rule conditions are met. Define these actions by selecting 61. Work With Actions from the main menu; then select an action from the list or press F6 to create a new action. 6

7 Modify Alert Message 5. To define user action audit activities, Select 1. OS/400 Audit Features > 31. User Activity Auditing from the OS/400 Audit Features menu, and then: Select a user from the list or press F6 to add a new one. Select object and user action auditing parameters as appropriate. Work with User Auditing 6. Audit all attempts to access certain critical objects (database files, source code files or key libraries) by selecting options 41, 42, and 45 from the OS/400 Audit Features menu. 7

8 In option 41. Native Object Auditing, select an item from the list (or create a new item), and define the object auditing parameters in the appropriate fields. In option 42. IFS Object Auditing, select an object definition from the list or add a new object definition. Then type the desired object auditing value in the appropriate field. Define default object audit settings for newly created objects. In option 45. Defaults for Object Creation, type library name or *ALL to display all libraries. Note that a generic name can be specified to display a subset. Then type a number representing the default audit setting in the space to the left of the library name. Using Queries and Reports Audit s powerful query wizard includes options for creating sophisticated queries. Output from queries can printed or displayed on your screen. Report queries can be run at designated times using the Report Scheduler feature. Audit comes with more than 80 ready-to-use queries and reports. To work with queries and reports, select 41. Queries and Reports from the main menu. The Queries menu appears. Queries Overview Queries Use the Query Generator to define queries that present the information that you need in the manner that you wish to see it. The overall process is simple: i. Select the transactions to be reviewed, based on the contents of individual fields, in the audit journal log. ii. Define exactly which data items will appear in the report and how they will be displayed and sorted. To define a new query or modify an existing query with the Query Generator, perform the following steps. 8

9 1. In 1. Work with Queries from the Queries menu, select a pre-defined query from the list or press F6 to create a new query. Define the query type, entry type, output format and sorting parameters in the appropriate fields, and press Enter to continue. 2. In the Filter Condition screen, define the record selection criteria for the query. Criteria may be based on any combination of fields in the journal record using Boolean operators and conditions such as: and or equal to less than or greater than like contained in list, etc. Filter Conditions 3. On the Output Fields screen, select fields to appear in query output and their order of appearance. 9

10 Select Output Fields 4. On the Sort Fields screen, define the sort order for records extracted by the query. Select Sort Fields 5. At the conclusion of the definition process, you may optionally run your query. To display query results on the screen, select 11. Display from the Queries menu. Enter the query name and scope parameters. To print query results select 12. Print from the Queries menu. Enter the query name and scope parameters. From the list of queries type 5=Run to run the query interactive, 8= Run as batch job or 6=Print: 10

11 Select preferred Output file type (*PDF, *HTML, *CSV ) and press Enter To send the report to an address type *MAIL in the Object field, press Page Down and enter the address you want the file to be sent to in the Mail to field. Press Enter to run the print. 11

12 Report Scheduler Overview Define report groups that run automatically at specified dates and times by using the Report Scheduler. A report group is a user-defined collection of individual reports that are run together as a group. 1. Select 51. Work with Report Scheduler from the Queries menu and select a report group to modify (or press F6 to define a new report group). Work with Report Scheduler 2. Define or modify the report group as follows (press Enter after each step): Type a description on the Report Group screen. Enter report group scope parameters on the Report Group Details screen. Enter report group schedule parameters on the Change Job Schedule Entry screen. Add or modify individual reports to a report group as follows: Log Display On the Work with Report Scheduler screen, select an existing report to be modified, or type 2 next to the report group to add a report to that group. Type a description on the Report Definition screen. Press F7 to choose between a querybased report or the audit journal log. Press F4, enter the appropriate report scope parameters (start date, end date, audit type, user, etc.) and press Enter to finish. Audit provides several ready-to-use queries that allow you to display journal log entries in their native format, according to audit type or subject matter. Log queries use the DSPAULOG command. To display the audit journal log: 1. Select 42. Display Log from the main menu and choose one of the pre-defined display options from the Log Menu. 2. Enter the appropriate run-time filter parameters and press Enter to display the log. 12

13 Display Audit Log 3. Press F6=Add New to add a new rule in accordance with the data in the log file. 13