Configuring parameters

Where the products require additional configuration parameters, you can add these parameters to the existing 

BMC AMI Resident Security Server

 (

RSS

) configuration parameters.This section describes all the configuration parameters supported by the product. Many of the parameters are optional and most implementations use only a subset.

• Configuration parameter syntax
• Configuring SCOPE parameter
• Multiple configuration parameter members
• Configuration parameter groups
• Global configuration parameters
• HTTP server configuration
• Event targets configuration
• Security Policy Manager and SIEM systems
  
• Security Policy Manager parameters
• Sample configuration parameters
• Where to go from here

Configuration parameter syntax

The parameters in the configuration data set conform to the following rules:

• Enter only one parameter on each line. A parameter can start in any position on that line.
• Specify parameters in full. They are not case sensitive except for HFS path names.
• Add an asterisk (*) in the first position to make it a comment.
• Use standard z/OS system-defined static system symbols, such as &SYSNAME.

Configuring SCOPE parameter

You can share parameters in the configuration data set between multiple address spaces and multiple LPARs.

The SCOPE parameter controls which parameters in the configuration data set are processed by which LPAR in each address space. Use the SCOPE keyword before a block of one or more configuration parameters to indicate that the block is processed only by the address spaces that have that LPAR. The scope for each address space is defined on the SCOPE= parameter in the EXEC PARM in the JCL procedure.

You can qualify the SCOPE keyword with the SYSID, allowing different parameter blocks to be processed depending on the system that Security Policy Manager is started on.

The following example displays different uses of the SCOPE parameter:

Multiple configuration parameter members

You can split the BMC AMI Security Policy Manager configuration parameters across multiple members for simplification, ease of administration, or to share commonly used blocks of parameters across multiple address spaces.

You can include other members in the parameters using the INCLUDE keyword, as displayed in the following example:

Configuration parameter groups

Except for the global configuration parameters , BMC AMI Security Policy Manager c onfiguration parameters are organized in groups, with a group header and group trailer parameter.

This enables similar parameter keywords, such as PORT or IPAddress, to be placed inside different groups without conflict. The typical format of a parameter group is displayed in the following example:

Do not split parameter groups across different configuration data set members.

Global configuration parameters

The global configuration parameters are applicable to every BMC AMI Security Policy Manager address space. Global configuration parameters are not defined within a parameter group.

They can be placed inside a SCOPE block to define different values for different address spaces. 

The following list of global configuration parameters are required unless otherwise specified.

With SPE2107 applied, support for ACF2 is available.

HTTP server configuration

Use the following parameters if the HTTP server is used to support browser-based connections to the Security Policy Manager implementations.

Regardless of the connection type, set the value of the Protocol parameter to HTTP, and the appropriate AT-TLS rules setup to achieve the secure connection.

The HTTP server parameters must be defined within an HTTPServer group:

Event targets configuration

Event target parameters are used to specify the details of external systems to receive events generated by BMC AMI Security Policy Manager. Every event generated is assigned a severity. Multiple target systems can be defined to receive events that are filtered by severity.

Security Policy Manager also supports routing events to the MVS console and the local syslog daemon, as well as external SIEM systems.

The target systems must be defined within an 'EventTarget' block. One EventTarget block is required for each target system:

Security Policy Manager and SIEM systems

Security Policy Manager sends alerts to SIEM systems from the following sources:

• SMF 14—File closed after reading
• SMF 15—File closed after writing
• SMF 42—PDS activity
• SMF 80—RACF or Top Secret events and audited events
• SMF 230 (variable)—ACF2 events
• z/OS commands—Commands entered on the console RACF or Top Secret commands. Any RACF-related command is valid.
• z/OS console messages—All messages are checked and analyzed
• SYSLOGD events—These events are analyzed, and if deemed of interest, they are sent to SIEMs or dashboards and stored in the database.

However, because the code is in place to intercept all SMF records and send to SIEMs, Security Policy Manager can intercept any SMF record type except for the types listed previously (SMF 14, 15, 42, and 80). With minor changes, Security Policy Manager can process them and send them to a SIEM system, or just forward the entire record to the SIEM (after sanitizing binary fields). Similarly, with Console Messages and Commands, Security Policy Manager can forward all commands.

For example, Security Policy Manager can receive a specific console message (such as from TPX), and send the result directly to the SIEM for further processing. This consists of a few dozen lines of code, and could be activated by a configuration change.

When a SIEM is configured and defined to Security Policy Manager, you can specify which of the following levels (as defined by RFC5424) is sent:

• EVENT_EMERGENCY
• EVENT_ALERT
• EVENT_CRITICAL
• EVENT_ERROR
• EVENT_WARNING
• EVENT_NOTICE
• EVENT_INFO
• EVENT_DEBUG

The following events are also used within Security Policy Manager:

• EVENT_SUMMARY—Send to dashboard only
• EVENT_DASHBOARD—Send to SIEM only

The levels are as follows:

Security Policy Manager parameters

Some additional configuration parameters are required for BMC AMI Security Policy Manager.

To start Security Policy Manager, you must set an Activate ZDETECT configuration statement in the global configuration parameters.

(SPE2107) You can use the RECONFIG command to configure some parameters later. For more information, see Reconfiguring-parameters.

Sample configuration parameters

A sample of the Security Policy Manager c onfiguration data set members using some of the parameters described earlier in this topic follows:

The sample uses different members to illustrate how multiple members are used, but all configuration parameters could be saved in a single member.

Sample Global Member

Sample Server Member(SRVSYS1)

Sample Event Targets Member (TARGET)

Sample SPM Member (ZDT)

Where to go from here

After you configure the product parameters, create a started task user.