Select Page

Refuel your enterprise audit solution with the most comprehensive and complete z/OS audit data

Plug & play SIEM connector for your z/OS mainframes (e.g. Splunk, ArcSight, QRadar, etc.

Ultimate hardening, streamlining and consolidation of your audit & security trails.

Log –  Block – Modify.

Allows for the replacement of password and security exits

Target your true auditing & security enemies!

Systems and processes never tell you the whole story. But complete and authentic logs are a prerequisite for both proper IT operation and complete auditing & compliance – including effective detection of fraud and abuse. You may not believe this, but much of the essential and highly critical activity on your recognized z/OS mainframe simply does not come to your attention since it is not logged or properly protected.

The triad of smart and smooth z/OS command and system service verification includes logging, blocking and modifying.
SF-NoEvasion for z/OS allows for the ultimate hardening and transparency of your audit trails with regards to the suppression of information, bypassing, fraud and abuse. It also improves and enhances critical security controls to allow for highly precise and flexible decisions about how they are to be used! Become the boss by finally knowing the complete story on what’s happening on your z platform!

The plug & play Real-Time Sniffer, Spool Monitor, File Watcher, Universal Log Scanner and Event Forwarder finally lets you feed all your security and compliance monitoring applications with event data – with utmost completeness and speed. The included PC-based system for Security Information and Event Management (SIEM) provides a high-performance audit workflow. As an option, it lets you also include events of non-mainframe platforms, such as Windows, UNIX, Linux, etc.

Highest security and compliance levels for the z/OS mainframe platform are requestedAll security and compliance standards, like SOX, PCI, ISO, FERC, DOD, HiPAA, etc., claim full (100%) transparency and the ability to audit completely all processes in your company’s IT. Missing audit information represents a top-level risk, implying the impossibility of effectively detecting fraud, abuse and non-compliant behavior.

But how can incomplete logs be possible on platforms that have received the highest levels of [security] certifications? Your fear is reasonable! Various processes may be involved, such as invalid system configurations, critical system services supporting “no logging” features, tricky log suppression, bypassed security mechanisms, and much more. High-value compliance certifications may easily become invalidated in cases of incomplete audit data. Skilled software vendors, staff, or parties with malicious intent may easily dupe you by hiding the “actual truth”, and, furthermore, putting into question your company’s compliance and the legal protections of your auditing.

SF-NoEvasion profits from the experience of having penetrated and assessed mainframes for over a decade to achieve extremely secure environments.


It provides comprehensive and smart command and system service verification to completely audit and protect all critical z/OS components, including Security Server (RACF), user authentication, user password change, console commands, FTP, and much more. At last, you no longer have to put up with any potential weaknesses in your audit trails, and you can finally achieve the highest level of automated controls and completeness in your compliance strategy!

Finally, you know all of what’s involved in becoming really compliant and secure!


Over the past several years, compliance has become more and more an important issue, but also a tedious task. Our SF solutions assist you in automating the resulting workload to the max by also covering the entire mainframe platform - thanks to a 360-degree approach.


With SF-Sherlock, you can also protect your mainframe platform against attacks and combat high-level risks. Thanks to our max approach this also includes malicious code and exploits. Yes, both of these are real risks on the mainframe platform!

Are you expecting a governmental audit of your mainframe platform soon, as
by the BaFin, ECB, or one of
the “Big Four”?

Let us help you prepare your mainframe security and compliance.

+800 - 37 333 853 or simply dial: +800 - DRFEDTKE

Call our world-wide toll-free number now!

(+ represents the prefix for international calls; in most countries it is 00, and you have to dial 00800-37333853; in the U.S. it corresponds to 011)

News & IT Security Forum

System REXX and BCPii are the ”next APF“

If you look back along the evolutionary steps of mainframe security, APF libraries play a leading role – due to their “superpower.” Until the 1980s, “almost anyone” working on a mainframe was able and allowed to define one themselves. In most cases, there was no APF library protection at all. Then there was a phase where APF-related auditing received more and more attention, and correspondingly became an important audit issue.

The attention that “APF” received as a security risk has continued to increase over time. Today, it has almost reached the highest level of awareness: only a very few members of a company’s mainframe team are allowed to define a new APF library or update existing ones. Any such action requires prior permission, not just some documentation after it has happened. On our customer visits, we have seen companies where a new APF library requires not only an official change request, but up to “5 signatures.” Otherwise, you lose your job. Correspondingly, relentless monitoring and compliance reporting has become standard for the “APF” risk, resulting in real-time security alerts by a SIEM if corresponding rules are bypassed.

So far, so good. Now that there is great awareness of “APF,” the question will be if the entire mainframe security mission has now been accomplished? Or what’s the next superpower, following “APF,” that mainframe users need to focus on?

Based on our worldwide penetration testing experience, we have determined that “System REXX” and “BCPii” are two further members of the superpower league; both are good candidates for becoming the next “big focus.” In recent years, both z/OS features have been improved so that they are now “easy-to-use” functions. But there is no free lunch. As a consequence, highly critical operations became minimally complex, and you have to “pay” the price for setting up gap-free security measures. User-friendly and easy-to-use superpower features are an invitation to attackers. Complexity is a kind of protection. Compared to assembler programming or disassembling machine code, REXX programming is pretty trivial!

This is why SF-Sherlock focuses intensively on both of these areas. Please feel free to contact us to discuss additional details of what is necessary to properly protect System REXX and BCPii.

Worldwide toll-free phone number

+800 - 37 333 853
or simply dial:

+41 (0)41 710 7444

(+ represents the prefix for international calls; in most countries it is 00, and you have to dial 00800-37333853; in the U.S. it corresponds to 011, and you have to dial 011-800-37333853)

Find Us


Seestrasse 3a, 6300 Zug, Switzerland

Visitors & Training

Dammstrasse 19, 6301 Zug, Switzerland

Social Media

Xing → Linkedin →

Write Us

copy the address

Technical support and hotline
copy the address

Legal and compliance
copy the address

error: Content is protected!