Collect Precisely Ironstream for IBM z/OS logs

Supported in:

Google secops SIEM

This document explains how to ingest Precisely Ironstream for IBM z/OS logs to Google Security Operations using the Bindplane agent.

Precisely Ironstream for IBM z/OS is a mainframe data streaming solution that captures SMF records, syslog, and security events from IBM z/OS systems. Ironstream streams log data from the mainframe to a landing zone server, which can then forward those logs via syslog to the Bindplane agent.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Windows Server 2016 or later, or Linux host with systemd
• Network connectivity between the Bindplane agent and the Ironstream landing zone server
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
• Privileged access to the IBM z/OS system running Precisely Ironstream
• Ironstream configured to export SMF records, syslog, or security events to a landing zone server

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File.

4. Save the file securely on the system where Bindplane will be installed.

   Note: This JSON file contains credentials for authenticating the Bindplane agent to Google SecOps.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.

3. Copy and save the Customer ID from the Organization Details section.

   Note: The customer ID is required for configuring the Bindplane agent exporter.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. Wait for the installation to complete.

4. Verify the installation by running:

   sc query observiq-otel-collector
   

   The service should show as RUNNING.

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

3. Wait for the installation to complete.

4. Verify the installation by running:

   sudo systemctl status observiq-otel-collector
   

   The service should show as active (running).

Additional installation resources

For additional installation options and troubleshooting, see the Bindplane agent installation guide.

Configure the Bindplane agent to ingest syslog and send to Google SecOps

Locate the configuration file

• Linux:

  sudo nano /opt/observiq-otel-collector/config.yaml
  

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

Edit the configuration file

• Replace the entire contents of config.yaml with the following configuration:

  receivers:
      tcplog:
          listen_address: "0.0.0.0:514"
  
  exporters:
      chronicle/ironstream_zos:
          compression: gzip
          creds_file_path: '/etc/bindplane-agent/ingestion-auth.json'
          customer_id: '<customer_id>'
          endpoint: malachiteingestion-pa.googleapis.com
          log_type: IRONSTREAM_ZOS
          raw_log_field: body
  
  service:
      pipelines:
          logs/ironstream_to_chronicle:
              receivers:
                  - tcplog
              exporters:
                  - chronicle/ironstream_zos
  

Configuration parameters

Replace the following placeholders:

• Receiver configuration:

  • listen_address: IP address and port to listen on:
    • 0.0.0.0 to listen on all interfaces (recommended)
    • Port 514 is the standard syslog port (requires root on Linux; use 1514 for non-root)

• Exporter configuration:

  • creds_file_path: Full path to ingestion authentication file:
    • Linux: /etc/bindplane-agent/ingestion-auth.json
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • customer_id: Customer ID copied from the Google SecOps console
  • endpoint: Regional endpoint URL:
    • US: malachiteingestion-pa.googleapis.com
    • Europe: europe-malachiteingestion-pa.googleapis.com
    • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
    • See Regional Endpoints for complete list

Save the configuration file

• After editing, save the file:
  • Linux: Press Ctrl+O, then Enter, then Ctrl+X
  • Windows: Click File > Save

Restart the Bindplane agent to apply the changes

• To restart the Bindplane agent in Linux, run the following command:

  sudo systemctl restart observiq-otel-collector
  

  1. Verify the service is running:

     sudo systemctl status observiq-otel-collector
     

  2. Check logs for errors:

     sudo journalctl -u observiq-otel-collector -f
     

• To restart the Bindplane agent in Windows, choose one of the following options:

  • Command Prompt or PowerShell as administrator:

    net stop observiq-otel-collector && net start observiq-otel-collector
    

  • Services console:

    1. Press Win+R, type services.msc, and press Enter.
    2. Locate observIQ OpenTelemetry Collector.
    3. Right-click and select Restart.

    4. Verify the service is running:

       sc query observiq-otel-collector
       

    5. Check logs for errors:

       type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
       

Configure Ironstream syslog forwarding

Precisely Ironstream streams log data from IBM z/OS to a landing zone server (Linux or Windows). Configure the landing zone to forward those logs via syslog to the Bindplane agent.

1. Sign in to the Ironstream management console on the landing zone server.
2. Go to Configuration > Output Destinations.
3. Click Add Destination to create a new syslog output.
4. Provide the following configuration details:
   • Destination Type: Select Syslog.
   • Syslog Server: Enter the IP address of the Bindplane agent host (for example, 192.168.1.100).
   • Port: Enter 514.
   • Protocol: Select TCP.
   • Format: Select BSD (RFC 3164) or IETF (RFC 5424) based on your requirements.
5. Select the data sources to forward:
   • SMF records
   • z/OS syslog
   • Security events (RACF, ACF2, or Top Secret)
6. Click Save to apply the configuration.
7. Restart the Ironstream service to activate the new output destination.

8. Verify logs are being received by checking the Bindplane agent logs.

   Note: Refer to the Precisely Ironstream documentation for detailed configuration options. Ironstream supports streaming multiple z/OS data types simultaneously to the same syslog destination.

UDM mapping table

Log Field	UDM Mapping	Logic
jsondata.*	additional.fields	Additional data that doesn't fit into the standard UDM schema
	metadata.event_type	Type of event (e.g., USER_LOGIN, NETWORK_CONNECTION)
SMF119SC_SARIP_IPV4_0001, SMF119SC_SALIP_IPV4_0001	principal.asset.ip	IP address of the asset associated with the principal
SMF119SC_SARIP_IPV4_0001, SMF119SC_SALIP_IPV4_0001	principal.ip	IP address of the principal
DESTINATION_SEQUENCE_NUMBER	target.resource.attribute.labels	Labels associated with the target resource
	metadata.product_name	Name of the product that produced the log
	metadata.vendor_name	Name of the vendor that produced the log

Need more help? Get answers from Community members and Google SecOps professionals.