SecureWorks' AS400 monitoring solution is comprised of two components: an Agent, which resides on the AS400 itself, and Inspector. The Agent is pre-configured to monitor the key security message queues QSYSOPR and QSECOFR, as well as the Audit Journal (QAUDJRN) of the AS400 system. SecureWorks has engaged a leading AS400 consulting and monitoring software firm to implement AS400 security best practices into the Agent, which in turn provides our Analysts with appropriately categorized severities out-of-the-box. Inspector and Sherlock process these events just like any other device to identify true events of interest to your organization.
The following document discusses AS400 system security and best practices.
Information Security Research Library
