DORA and FINMA sustainably increase the demands on IT security and resilience. One aspect of the proactive regulations concerns the more negative situations and aspects of an incident and how to deal with them, known as incident management. Such an incident necessitates a short-term, in-depth forensic analysis. The results of this analysis must be profound. Why? Since the decision on the restore point may be based on them. And don’t forget the stress level in such a situation. In the case of the mainframe, the logs and events kept online in the SIEM are often not 100% and potentially insufficient for the required deep-level analysis. Why? Because the total volume of data would often be too large for a truly complete SIEM delivery. What consequences does this have for DORA-related incident management? Your IT must always be able to provide the forensics team with the complete inventory of forensic data at short notice for selective periods of time, in an environment that is familiar to them and therefore performs well in terms of analysis. This is usually the SIEM, such as Splunk, ArcSight or QRadar, and not the TSO ISPF environment.

To support your mainframe environment with regard to this DORA aspect, SF-Sherlock’s PTF Level 095 also includes a “Forensic Swiss Knife for z/OS.” This allows you to prepare for this situation in accordance with DORA and FINMA. It works ON REQUEST to provide the SIEM with 100% of the necessary forensic data for a selected date and time range. It’s desgined to work even if top specialists are unavailable. The only step you need to take is to create the corresponding documentation in the operating manual. Such incident-related SIEM 100% filling should also always be part of the emergency drills required by DORA and FINMA.

SF-Sherlock’s new integration with z/OS System Automation further strengthens the DORA objective of maximum resilience. The new SF-Sherlock 2 System Automation integration kit makes linking event monitoring to the Z System Automation solution a simple process. This also makes the automation team an integral part of the line of defense around the mainframe. Please contact our support if you have not yet received the download link.