1. Syslog for SIEM Products Using iSecurity Real-Time Monitoring of IBM i Security Events

2. Syslog – Why and How? Fact: Multi platform environments are increasingly the norm worldwide Goal: To consolidate relevant event information from multiple environments to a single console This requires a SIEM (Security Information & Event Manager) solution Optimally, security event information should be both infrastructure related and also application related. Method: Syslog is the most widely used protocol for sending alert messages in real time to SIEM solutions. iSecurity products for IBM i security, auditing and compliance interface with the SIEM solutions on the following slide

3. OEM Business Partners

4. System Information & Event Manager (SIEM) Products IBM i PC LinuxUnixMF Individual & Multiple IBM i Systems iSecurity Syslog (After optional filtering) Typical Syslog Environment … and other SIEM Products

5. Issue Real-Time Alerts via iSecurity Action QAUDJRN (Audit) Network Security (Firewall) Critical OS messages (QSYSOPR/ QSYSMSG) Database Journals (AP Journal) Authority changes (Authority on Demand) Real-Time Alert handling in iSecurity Execute CL Scripts Send e-mailWrite to SYSLOG Write to MSGQ Send SMS text message, SNMP, Twitter, etc.

6. 6 Syslog supported in nearly all iSecurity solutions! * Indicates syslog is not relevant for solution Evaluation Visualizer* Business Intelligence for Security Compliance Evaluator* for SOX, PCI, HIPAA… SIEM/DAM Support Syslog, SNMP Central Admin* Multi LPARs Auditing Audit QAUDJRN, Status… Real-time Actions, CL scripts Capture screen activity Compliance: Users, Native, IFS Change Tracker User Provisioning Protection Firewall FTP, ODBC,… access Obtain Authority on Demand Monitor CL Commands Password Reset 2 Factor Authentication* Anti-Virus protection Database AP-Journal DB Audit, Filter, Alerts, SIEM DB-Gate* Native SQL to Oracle, MSSQL.. FileScope Secured file edito r Security Assessment (free) PCI, HIPAA, SOX, JSOX, FDA, Local Regulations, Auditor’s Requests… Security Breach Management Decision Encryption DB2 Field Encryption* (FIELDPROC) PGP Encryption*

7. iSecurity Syslog Features (1/2) Sends security event alerts simultaneously to up to 3 SIEM products / IP addresses Sends security event information originating from: the system’s infrastructure (QAUDJRN, network access, virus detection, user profile changes, user requests for stronger authorities, etc.) business-critical applications, both from field level writes & updates and also unauthorized READ accesses to sensitive data Single keyword support for LEEF (QRadar) and CEF (ArcSight) formatted messages Supports UDP, TCP and encrypted TLS syslog types

8. iSecurity Syslog Features (2/2) Includes advanced filtering capabilities and specific severity settings to fine- tune which events are sent to a particular SIEM “Super fast” iSecurity Syslog implementation enables sending extremely high volumes of information with virtually no performance impact. Syslog message structure is easily definable by each site and can include event-specific values such as user profile name, IP address, field-level before & after values, etc. Syslog Self-Test enables pre-testing syslog messages to a local server before actually sending the messages to a remote Syslog server

9. Syslog Success Stories (names available upon request) Large insurance company Sends all field-level data changes via AP-Journal’s Syslog facility to SIEM Monitors changes to ensure that only authorized PROD* users who also have “change” authority, are the ones who changed data by more than X% or by a specific amount. More than 1000 transactions/second are sent via Syslog; CPU overhead <1% Benefit: It is much easer to manage the journal change file on a PC rather than on an IBM i AP-Journal also produces field-level change reports which are sent to corporate and application managers Second phase of the project was the integration of Syslog from Audit (based on QAUDJRN system journal) and Firewall

10. Syslog Success Stories (names available upon request) Very large mortgage bank Monitors all Firewall network access rejects, sending reject information via Syslog to SIEM Monitors all QAUDJRN system journal activities via Audit, sending important event information via Syslog SIEM performs advanced forensic analysis on Firewall and Audit log information Use iSecurity to provide audit reports to both internal and external auditors

11. Syslog Success Stories (names available upon request) Large national airport authority For years they sent alerts to internal AS/400 message queues. Simply by checking message headers, the Syslog facility now sends SNMP alerts to a SIEM product. All definitions of new user profiles with high authorities, or changes to such user profiles, are sent as SNMP alerts. Implemented “mass SNMP” capability; they defined which QAUDJRN audit types DO NOT send SNMP traps, and all QAUDJRN entries with the other audit types therefore automatically send, en masse, event information. Accomplished with very little overhead.

12. Main Control Screen for SIEM & DAM Up to 3 SIEM servers are supported.

13. Syslog Attribute Definitions Maximum message structure flexibility. Support for LEEF & CEF formats. Syslog Parameters are easily defined. This option is shown on the following slide.

14. Set Syslog handling per Audit sub-type Severity level can be set for each audit entry-type / sub-type combination and for each of up to 3 SIEM servers.

15. Syslog Self-Test: Pre-test syslog messages locally before sending to remote Syslog server

16. GUI- Set Syslog handling per Audit sub-type

17. Variables beginning with & are replaced with actual event values. &DPRICE(B) is the previous price (“before value”) of the item. Defining Syslog message format in Action

18. Syslog messages: note multi- product, multi-system & multi- IP messages. Syslog Messages in (free) Kiwi Syslog Daemon

19. Note real-time user-defined messages from AP-Journal include before and after quantity and price values. Syslog Messages in (free) Kiwi Syslog Daemon

20. Syslog in iSecurity – Summary Easy to define, Easy to use, Easy to implement Fully parameterized, includes event-specific variable substitution Proven integration with nearly all SIEM products; native support for LEEF (QRadar) and CEF (ArcSight) Sends messages to up to 3 SIEM products simultaneously Supports UDP, TCP, TLS Includes Self-Test to send messages locally prior to sending to a remote Syslog server Success Stories available

21. Thank You! Visit us at www.razlee.com marketing@razlee.com