The Ironstream security starter pack for IBM Z is an example app that provides pre-built dashboards for your splunk installation. These dashboards preview common searches and scenarios based on security data that Ironstream sends from your z/OS environment.
This version of the Ironstream security starter pack for IBM Z supports the following security products:
- RACF
- ACF2
Note: These instructions are based on the latest versions of splunk Enterprise 8.0 deployed on-premise. Steps may vary depending upon the version and environment you are using, and different configuration steps may be required for a successful deployment.
Note: Before using this add-on, see the Terms of Use for Ironstream splunk® Related Add-Ons.pdf.
The Ironstream security starter pack for IBM Z includes example dashboards that show how to monitor your security issues. For example, RACF writes record type SMF 80 to record interactions with protected resources, and ACF2 writes record type SMF 230.
Note: Your security product and the SMF configuration on z/OS dictate what is created for Ironstream to collect. Therefore, you must check the appropriate configurations to ensure they meet your reporting requirements.