Navigator for i - Trivializing SIEM Integration

Problem Statement

Network and Security Operation Centers have a high desire to utilize SIEM technologies to centralize the logging of health, service status, system status, etc... of various appliances (both hard and software) in the enterprise. As the IBM system administrator I want to easily make available the information they need to centralize the alerts and emergency paging in system health degradation or downtime. Currently for the NOC and SOC to gain this level of visibility into the IBM system they not only have to have a profile that can sign into the IBM system, but their profile also needs access to Navigator and needs to be properly restricted through function usage.

Proposed Solution

In the tools provided in Navigator we can construct metric graphs with threshold values where when hit, programs can be called with parameters. My suggestion is to also enable the raw gathered data to be written to IFS in a format that most SIEMs can consume if they are monitoring the shared folder and file for changes. Suggested file type options include: CSV, JSONL, and CEF. A stretch objective of this feature would be to rotate the file on a daily basis to make cleanup of old log data trivial and reduce redundant storage since the SIEM would have a copy of the metric data indexed once it was ingested.

Sample Proposed Output

EVENT_TIME,CHART_NAME,Y-VALUE,THRESHOLD1*,RESET1*,THRESHOLD2*,RESET2*

*: Indicates optional value that could be controlled via SIEM to reduce filesize of "spooled" metric output.