AuditTN - Session Tracking & Auditing TN3270
Audit-TN is a tracking and auditing system for mainframe environments that logs all network user activities, providing evidence of these actions and reconstructing every screen accessed—including user keystrokes, dates, times, ports, and IP addresses for each operation.
Security and audit teams—particularly those involved in incident response—can receive real-time alerts regarding suspicious activity patterns and user behaviors. This enables immediate, proactive investigative actions based on historical records, helping to anticipate potential irregularities that could jeopardize business continuity.
No user escapes having their activity logged during TN3270 emulation sessions; all actions can be retrieved and viewed via a dynamic preview feature with pause and fast-forward controls, as well as export options for AVI, HTML, or text formats.
Audit-TN captures and replays sessions across network segments—targeting specific users or utilizing search capabilities based on networks, subnets, strings, date/time ranges, terminal names, and other attributes.
In this context, the solution also ensures compliance with LGPD regulatory requirements regarding the confidentiality of sensitive information and user data.
Benefits:
• Continuous monitoring of user actions leads to significant cost savings by reducing fraud incidents.
• Evidence of fraud and other suspicious activities supports administrative or legal actions.
• Users with fraudulent intent are deterred by the tracking of their access and real-time alerts regarding suspicious events.
• Provides audit and security teams with a comprehensive view of each user's actions through session replays or documentation in video, web, and text formats. • Upon identifying an incident, it guides the security team in resolving the issue, accelerating actions and minimizing the impact on the resumption of normal business operations, while also helping to eliminate the source of the failure.
• Implementation entails no risks or additional traffic and is carried out non-intrusively, as the software operates by continuously collecting mirrored data from the switch.
Features :
• Real-time monitoring and alert generation for pre-configured situations.
• Historical archiving and complete indexing of actions, via TN3270.
• SSL support allows encrypted sessions to be monitored as well.
• Captures sessions that travel through one or more OSA interfaces.
• Indexed search of defined metadata (source IP, destination IP, port and time).
• String queries in the tracked packets.
• It replicates user actions, including fast-forward and pause functions.
• Generation of videos and reports for forensic evidence.
• Zero power consumption on the mainframe – ZERO MIPs.
• It does not impact network traffic.
