---
title: "IBM RACF Integration"
slug: "ibm-racf"
updated: 2026-11-02T22:13:21Z
published: 2026-11-02T22:13:21Z
canonical: "docs.hunters.ai/ibm-racf"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM RACF Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| IBM RACF SMF Audit Logs |  | ✅ |  | ✅ | ibm_racf_smf_audit_logs | JSON (CSV) | S3 |

## Overview

IBM RACF (Resource Access Control Facility) is the security subsystem for IBM z/OS mainframes that controls user authentication, authorization, and access to protected resources such as datasets, programs, and facilities. RACF writes audit records to SMF (System Management Facility), which are extracted and formatted into pipe-delimited text records capturing job initiations, logon/access successes and failures, resource access attempts, and other security-relevant mainframe activity. Integrating these logs with Hunters provides visibility into privileged user activity, dataset access control violations, job/batch execution context, and potential insider-threat or unauthorized access patterns on z/OS systems. This gives security teams a consolidated view of mainframe security events alongside the rest of their enterprise telemetry.

## Supported data types

### IBM RACF SMF Audit Logs

**Table name:** `ibm_racf_smf_audit_logs`

This data type contains RACF audit records unloaded from SMF, capturing access control decisions, job initiations, resource definitions/deletions, and related mainframe security events. Each record includes details such as the acting user, resource name and class, requested access, access decision, and system identifiers, providing a detailed audit trail of mainframe security activity.

**Expected format**

Logs are expected in JSON format, where each JSON record wraps a pipe-delimited RACF audit line in a `_raw` field, along with contextual metadata fields such as `host`, `source`, and `_time`.

`{"host":"prd-app-sv-7","source":"/woodmen/transfer/mft/mainframe/RACF/SMFRACF.CRIBL.DT251211.txt","_raw":"IBMRACF|ACCESS_SUCCESS|2025-12-12 00:00:01|USERX01|WOW|NO|NO|NO|USERX01|NFSGRP1|YES|NO|NO|NO|NO|NO|NO|NO|NO|YES|NO|NO|NO|NO|NO|NO|000|NO|NO||CONTROLM|01:47:13|2025-11-03||NO|NO|NO|NO|NO|NO|NO|NO|NO|NO||77C0|OCS.IOA.TEMP.JCL|READ|READ|000|PROD06||DATASET||PROFILE|OCS.IOA.**|DSNDEP|||AUTO OPS SCHEDULING||NO|NO|NO|NO|YES|NO|NO|NO|NO|NO||NO|NO|NO||||||||USERX01|NFSGRP1|YES|YES||||||||||||||||||||||||||||||||||||||||||||","_time":1765519201,"cribl_breaker":"fallback","cribl_pipe":["passthru","passthru"]}`

## Send data to Hunters

Hunters supports the collection of IBM RACF SMF Audit logs using Amazon S3.

**To connect IBM RACF SMF Audit Logs:**

1. Extract and format RACF SMF audit records into pipe-delimited records (for example, via an `IRRADU00`/`ICETOOL`-type unload process), as described in the [RACF user record formats documentation](https://www.ibm.com/docs/en/zos/3.1.0?topic=utility-user-record-formats) and the [RACF user template documentation](https://www.ibm.com/docs/en/zos/3.1.0?topic=ffd-user-template-racf-database).
2. Transfer the resulting pipe-delimited RACF records from the mainframe to your SFTP/MFT drop location.
3. Use a log processing pipeline (such as Cribl) to wrap each pipe-delimited record in JSON, including contextual fields such as `host`, `source`, `_time`, and `cribl_breaker`, and the raw record in a `_raw` field.
4. Route the resulting JSON logs into an AWS S3 bucket.
5. Once logs are in S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3) to connect the bucket to Hunters.