SecureWorks' AS400 monitoring solution is comprised of two components: an Agent, which resides on the AS400 itself, and Inspector. The Agent is pre-configured to monitor the key security message queues QSYSOPR and QSECOFR, as well as the Audit Journal (QAUDJRN) of the AS400 system. SecureWorks has engaged a leading AS400 consulting and monitoring software firm to implement AS400 security best practices into the Agent, which in turn provides our Analysts with appropriately categorized severities out-of-the-box. Inspector and Sherlock process these events just like any other device to identify true events of interest to your organization.

The following document discusses AS400 system security and best practices.