Compliance Event Manager

The architecture of Compliance Event Manager (CEM) is designed for robust security event management on z/OS. The core components include the Event Collector, Event Processor, Data Warehouse, and Reporting Interface. The Event Collector resides on the z/OS system and monitors RACF, CA ACF2, and CA Top Secret for security events.

It also monitors sensitive datasets such as LPALIST, LINKLIST, APFLIST, and PARMLIB. The Event Collector uses native interfaces to capture events in real-time. The Event Processor receives events from the Event Collector, filters and formats the data, and prepares it for storage.

The Data Warehouse is a central repository for storing security event data. It is designed for scalability and efficient querying. The Reporting Interface provides access to the data through a web-based interface and APIs.

Communication between components occurs over TCP/IP. The Event Collector sends data to the Event Processor, which then sends data to the Data Warehouse. The Reporting Interface retrieves data from the Data Warehouse.

The data warehouse can be configured to use various database technologies. The system supports encryption for data in transit and at rest. The web interface allows for configuration and monitoring.

The CLI provides scripting and automation capabilities. The product was originally called CA Compliance Manager.