IBM RACF Integration

TL;DR

Overview

IBM RACF (Resource Access Control Facility) is the security subsystem for IBM z/OS mainframes that controls user authentication, authorization, and access to protected resources such as datasets, programs, and facilities. RACF writes audit records to SMF (System Management Facility), which are extracted and formatted into pipe-delimited text records capturing job initiations, logon/access successes and failures, resource access attempts, and other security-relevant mainframe activity. Integrating these logs with Hunters provides visibility into privileged user activity, dataset access control violations, job/batch execution context, and potential insider-threat or unauthorized access patterns on z/OS systems. This gives security teams a consolidated view of mainframe security events alongside the rest of their enterprise telemetry.

Supported data types

IBM RACF SMF Audit Logs

Table name: ibm_racf_smf_audit_logs

This data type contains RACF audit records unloaded from SMF, capturing access control decisions, job initiations, resource definitions/deletions, and related mainframe security events. Each record includes details such as the acting user, resource name and class, requested access, access decision, and system identifiers, providing a detailed audit trail of mainframe security activity.

Expected format

Logs are expected in JSON format, where each JSON record wraps a pipe-delimited RACF audit line in a _raw field, along with contextual metadata fields such as host, source, and _time.

{"host":"prd-app-sv-7","source":"/woodmen/transfer/mft/mainframe/RACF/SMFRACF.CRIBL.DT251211.txt","_raw":"IBMRACF|ACCESS_SUCCESS|2025-12-12 00:00:01|USERX01|WOW|NO|NO|NO|USERX01|NFSGRP1|YES|NO|NO|NO|NO|NO|NO|NO|NO|YES|NO|NO|NO|NO|NO|NO|000|NO|NO||CONTROLM|01:47:13|2025-11-03||NO|NO|NO|NO|NO|NO|NO|NO|NO|NO||77C0|OCS.IOA.TEMP.JCL|READ|READ|000|PROD06||DATASET||PROFILE|OCS.IOA.**|DSNDEP|||AUTO OPS SCHEDULING||NO|NO|NO|NO|YES|NO|NO|NO|NO|NO||NO|NO|NO||||||||USERX01|NFSGRP1|YES|YES||||||||||||||||||||||||||||||||||||||||||||","_time":1765519201,"cribl_breaker":"fallback","cribl_pipe":["passthru","passthru"]}

Send data to Hunters

Hunters supports the collection of IBM RACF SMF Audit logs using Amazon S3.

To connect IBM RACF SMF Audit Logs:

1. Extract and format RACF SMF audit records into pipe-delimited records (for example, via an IRRADU00/ICETOOL-type unload process), as described in the RACF user record formats documentation and the RACF user template documentation.
2. Transfer the resulting pipe-delimited RACF records from the mainframe to your SFTP/MFT drop location.
3. Use a log processing pipeline (such as Cribl) to wrap each pipe-delimited record in JSON, including contextual fields such as host, source, _time, and cribl_breaker, and the raw record in a _raw field.
4. Route the resulting JSON logs into an AWS S3 bucket.
5. Once logs are in S3, follow the steps in this section to connect the bucket to Hunters.