Mainframe Event Server System for SIEM Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity and proprietary format of mainframe event records make it difficult for third parties to efficiently analyze and interface with mainframe systems, particularly due to the high volume and variety of events, and the need for secure and efficient integration with Security Information and Event Management (SIEM) applications.
Innovation Solution
A mainframe event server system that converts mainframe events to an open format, selects appropriate SIEM applications based on rules, and routes events in the identified format for integration with SIEM applications, facilitating secure and efficient event management across systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mainframe events are kept in proprietary format for security and integrity, then system security is improved, but third-party analysis capability deteriorates
Solution Approach 1:
The patent introduces an intermediary component that translates mainframe events from proprietary format to standardized formats (CEF, LEEF, JSON). This intermediary enables third-party SIEM systems to analyze events without direct access to the mainframe, preserving security while providing analysis capability through format conversion.
2Reliability
If all mainframe events are transmitted to every SIEM application, then complete monitoring coverage is improved, but network bandwidth and processing load deteriorate
Solution Approach 1:
The patent implements local quality by routing different types of events to different SIEM applications based on their specific monitoring needs. The system determines which SIEM applications should receive which events, allowing each application to focus on relevant events rather than processing all events universally.
3Reliability
If multiple SIEM applications receive all events for comprehensive analysis, then analysis thoroughness is improved, but system complexity and resource consumption deteriorate
Solution Approach 1:
The system applies local quality by customizing event routing for each SIEM application based on its specific analysis requirements. This allows thorough analysis of relevant events in each application without the overhead of universal event distribution to all applications.
Data Source
AI summary
Methods, systems, and devices are described for managing mainframe events. In the methods, systems, and devices of the present disclosure, at least one mainframe event is received at a mainframe event server module communicatively coupled with a mainframe. The received at least one mainframe event may be converted to an open format. A destination Security Information and Event Management (SIEM) application may be selected for the received at least one mainframe event based on a set of rules, and a format associated with the selected destination SIEM application may be identified. The at least one mainframe event may then be transmitted in the identified format from the mainframe event server module to the selected destination SIEM application.