IBM zSecure Compliance

https://www.ibm.com/docs/en/zsecure-compliance
Admin
IBM zSecure Compliance is a security and compliance management solution for IBM Z systems that helps...
Tokens:207,488
Snippets:1,332
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### Start Compose Container for Installation (Docker)

Source: https://www.ibm.com/docs/en/zsecure-compliance/latest_topic=isizcezc-install-scz-in-zos-container-extensions-zcx-configuration

Launches the IBM Security Center for Z compose container for a new installation. It mounts necessary volumes and uses the `zscc.config` file for environment variables.

```bash
docker run -dt --name zscc-compose-container \
-v /var/run/docker.sock:/var/run/docker.sock \
-v zscc-tls-certs:/opt/cloud-gov/certs \
--env-file <absolute path to zscc.config file> icr.io/ibm-scz/compliance-compose:<version> bash
```

--------------------------------

### Example Pod Status Output (Kubernetes)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=ispirhocprc-refresh-solution-namespace-whenever-cluster-certificates-are-updated

This is an example of the expected output when verifying the status of pods for the IBM Security Center for Z installation. It lists the NAME, READY, and STATUS for each pod, confirming that they are in a 'Running' or 'Completed' state as required for a successful deployment.

```text
NAME                                                    READY            STATUS     
keycloak-xxxx                         1/1             Running     
postgres-0                                               1/1             Running  
scp-alembic-xxxx                      0/1             Completed       
scc-controller-xxxx                   1/1             Running    
scc-ui-xxxx                           1/1             Running    
```

--------------------------------

### Start Compliance Evidence Task with Parameters

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=task-operation-compliance-evidence-started

This snippet demonstrates how to start the Compliance Evidence started task with optional startup parameters. The DEBUG parameter enables diagnostic messages during initialization, useful for troubleshooting PARMLIB configurations. The FORCE parameter bypasses previous execution checks, to be used cautiously.

```JCL
S CKCS1154,,,DEBUG
```

--------------------------------

### z/OS Compliance Evidence Started Task JCL Configuration

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=task-configuration-compliance-evidence-started

This snippet shows how to configure the CKCS1154 started task JCL for the z/OS Compliance Integration Manager. It demonstrates setting the CPREFIX variable directly, which specifies the installation data set prefix.

```JCL
// SET CPREFIX=IBM.ZSCC
```

--------------------------------

### Start Compliance Evidence Started Task (JCL)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=task-operation-compliance-evidence-started

This JCL snippet demonstrates how to start the Compliance Evidence started task using the START command from the operator console. In production, it's recommended to automate this using system automation software or PARMLIB members for automatic startup after IPL. Optional parameters can be provided for diagnostic tests or forced initialization.

```JCL
S CKCS1154
```

--------------------------------

### Initialize Data Streamer TLS Setup (Shell Script)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=subscribers-securing-communications-using-certificates

This command runs the setupDataStreamerTLS.sh script to initialize the Data Streamer's TLS setup. It configures the Data Streamer to use TLS for communication with subscribers. The script requires a password argument, which is used for the Data Streamer's keystore and truststore files.

```shell
$CDP_DATASTREAMER/setupDataStreamerTLS.sh password
```

--------------------------------

### Start System Data Engine (z/OS Console Command)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=provider-running-system-data-engine

This command initiates the System Data Engine. Replace 'procname' with the actual started task name. Ensure the correct procedure name is used for successful execution.

```zsh
START procname
```

--------------------------------

### Create Self-Signed Root Certificate

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=isizcezc-install-scz-in-zos-container-extensions-zcx-configuration

Generates a self-signed root certificate and its private key using OpenSSL. This certificate is valid for 3650 days, has a common name 'example', and allows traffic for '*.example.com'.

```bash
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes -keyout rootCA.key \
-out rootCA.crt -subj "/CN=example" -addext "subjectAltName=DNS:*.example.com"
```

--------------------------------

### Start Compose Container for IBM Security Center for Z Backup

Source: https://www.ibm.com/docs/en/zsecure-compliance/latest_topic=configuration-steps-backup-restore

Starts a Docker container named 'zscc-compose-container' in detached mode to perform a backup of IBM Security Center for Z. It mounts necessary volumes for Docker socket, TLS certificates, and backup data, and uses an environment file for configuration. Replace <version> with the appropriate release version.

```bash
docker run -dt --name zscc-compose-container \
-v /var/run/docker.sock:/var/run/docker.sock \
-v zscc-tls-certs:/opt/cloud-gov/certs \
-v zscc-backup-volume:/opt/cloud-gov/backup \
--env-file <absolute path to zscc.config file> icr.io/ibm-scz/compliance-compose:<version> bash
```

--------------------------------

### Start Compose Container for IBM Security Center for Z Restore

Source: https://www.ibm.com/docs/en/zsecure-compliance/latest_topic=configuration-steps-backup-restore

Starts a Docker container named 'zscc-compose-container' in detached mode to restore IBM Security Center for Z. It mounts necessary volumes for Docker socket, TLS certificates, and backup data, and uses an environment file for configuration. Replace <version> with the appropriate release version.

```bash
docker run -dt --name zscc-compose-container \
-v /var/run/docker.sock:/var/run/docker.sock \
-v zscc-tls-certs:/opt/cloud-gov/certs \
-v zscc-backup-volume:/opt/cloud-gov/backup \
--env-file <absolute path to zscc.config file> icr.io/ibmz-scz/compliance-compose:<version> bash
```

--------------------------------

### Start IBM Security Center for Z Backup Container

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=configuration-steps-backup-restore

Launches a Docker container to perform a backup of IBM Security Center for Z. This command mounts necessary volumes and uses an environment file for configuration. Replace <version> with the specific release version.

```bash
docker run -dt --name zscc-compose-container -v /var/run/docker.sock:/var/run/docker.sock -v zscc-tls-certs:/opt/cloud-gov/certs -v zscc-backup-volume:/opt/cloud-gov/backup --env-file <absolute path to zscc.config file> icr.io/ibm-scz/compliance-compose:<version> bash
```

--------------------------------

### GET Classification Scheme API Request Example

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=csa-get

This example demonstrates how to retrieve a specific classification scheme using its ID via the API. It shows the URL structure for the GET request. The API allows fetching classification schemes by ID, name, or other unique identifiers, or retrieving all schemes within pagination limits.

```http
GET /sdtz/v1/classification/40 HTTP/1.1
Host: example.com
```

--------------------------------

### Make Script Executable (Shell)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=zcx-deploying-sensitive-data-tagging-z

This command makes the setup_volume.sh script executable, allowing it to be run directly. It's a prerequisite for executing the Docker volume setup.

```shell
chmod +x setup_volume.sh
```

--------------------------------

### GET Classification Scheme API Cookie Header Example

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=csa-get

This example shows the format of the 'Set-Cookie' header used for authentication when accessing the classification scheme API. It includes an example access token. Proper authentication is required to interact with the API endpoints.

```http
Set-Cookie: access_token=abc123hj90ghftyfg8900hj890bjkjk890h HttpOnly; Secure; SameSite=None
```

--------------------------------

### Execute Docker Volume Setup Script (Shell)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=zcx-deploying-sensitive-data-tagging-z

This command executes the setup_volume.sh script to create and mount necessary Docker volumes for SDTz. Administrative privileges might be required.

```shell
bash setup_volume.sh   # or sudo ./setup_volume.sh
```

--------------------------------

### Make Setup Scripts Executable

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=zcx-deploying-sensitive-data-tagging-z

Grants execute permissions to shell scripts. This is necessary before running scripts that generate keys or configure Docker environments.

```bash
chmod +x setup_keys.sh
chmod +x setup_docker_Id.sh
```

--------------------------------

### GET /sdtz/v1/scan-result

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=sra-get

Retrieves scan results with pagination. Users can specify the starting point (offset) and the number of records to return (limit). This endpoint fetches scan results in reverse chronological order.

```APIDOC
## GET /sdtz/v1/scan-result

### Description
Retrieves scan results with pagination. Users can specify the starting point (offset) and the number of records to return (limit). This endpoint fetches scan results in reverse chronological order.

### Method
GET

### Endpoint
`/sdtz/v1/scan-result`

### Parameters
#### Query Parameters
- **offset** (Integer) - Required - Specifies the starting point for retrieving scan results.
- **limit** (Integer) - Optional - Defines the maximum number of records to return per request. Defaults to 10.

### Request Example
```
GET /sdtz/v1/scan-result?offset=1&limit=10
```

### Response
#### Success Response (200)
- **status** (String) - Indicates the status of the operation (e.g., "SUCCESS").
- **code** (Integer) - The HTTP status code (e.g., 200).
- **message** (String) - A message describing the outcome of the operation.
- **timestamp** (String) - The date and time when the request was processed.
- **data** (Array) - An array of scan result objects.
  - **id** (Integer) - Unique identifier for the scan result.
  - **runId** (String) - Identifier for the scan run.
  - **dataObjectId** (Integer) - Identifier for the data object.
  - **scanRequestName** (String) - Name of the scan request.
  - **scanVersion** (Integer) - Version of the scan.
  - **sensitivity** (String) - Sensitivity level of the data.
  - **sysplexName** (String) - Name of the sysplex.
  - **idFromSubSystem** (String) - Identifier from the subsystem.
  - **lparName** (String) - Name of the LPAR.
  - **dataObjectType** (String) - Type of the data object.
  - **dataObjectName** (String) - Name of the data object.
  - **classificationTime** (String) - The date and time when the data was classified.
- **count** (Integer) - The total number of scan results returned.

#### Response Example (Success)
```json
{
    "status": "SUCCESS",
    "code": 200,
    "message": "Scan results fetched successfully",
    "timestamp": "2024-11-15 12:34:56",
    "data": [
        {
            "id": 25,
            "runId": "76LBDQZV",
            "dataObjectId": 4,
            "scanRequestName": "Db2 scan",
            "scanVersion": 3,
            "sensitivity": "SENSITIVE       ",
            "sysplexName": "",
            "idFromSubSystem": "270.3",
            "lparName": "",
            "dataObjectType": "DB2",
            "dataObjectName": "SYNTHDATA.USERS",
            "classificationTime": "2025-07-24 09:10:29"
        }
    ],
    "count": 4
}
```

#### Error Response (404)
- **status** (String) - Indicates the status of the operation (e.g., "FAILURE").
- **code** (Integer) - The HTTP status code (e.g., 404).
- **message** (String) - A message describing the error (e.g., "No scan results found.").
- **timestamp** (String) - The date and time when the error occurred.

#### Response Example (Error)
```json
{
    "status": "FAILURE",
    "code": 404,
    "message": "No scan results found.",
    "timestamp": "2024-11-15 12:34:56"
}
```
```

--------------------------------

### System Data Engine HBOIN DD Configuration

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=problems-system-data-engine-gets-abend-u006-startup

Example of the HBOIN DD card configuration for the System Data Engine. It shows how to set intervals, update targets, define file formats, and specify resources. Incorrectly commented-out lines can lead to startup issues.

```jcl
//HBOIN    DD *
SET IBM_SDE_INTERVAL = '1 MINUTES';
SET IBM_UPDATE_TARGET = 'PORT 51401';
SET IBM_FILE_FORMAT = 'CSV';
SET IBM_RESOURCE = 'EXIT';
//*SET IBM_RESOURCE = 'IFASMF.<resource>';
//* DD  PATH='/var/local/CDPServer/cdpConfig/Test1.sde', 
//* PATHDISP=(KEEP),RECFM=V,LRECL=255,FILEDATA=RECORD
/*

```

--------------------------------

### GET Latest Classification Schemes (API Response)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=csa-get

Example JSON response when successfully retrieving the latest classification schemes. Includes status, message, and an array of classification scheme objects.

```JSON
{
 "code":200,
 "status":"SUCCESS",
 "message":"Classification Schemes fetched successfully.",
 "timestamp":"2025-02-10 09:31:22",
 "data":[
    {
       "id":5,
       "name":"PCI",
       "creator":"IBM",
       "version":3,
       "isLatest":"Y",
       "description":"test version description",
       "createdUserId":"jdbcusr1",
       "modifiedUserId":"jdbcusr1",
       "createdTimestamp":"2025-02-10 09:30:59",
       "modifiedTimestamp":"2025-02-10 09:30:59",
       "dataClasses":[
          {
             "id":355,
             "mandatory":"Y"
          },
          {
             "id":352,
             "mandatory":"Y"
          },
          {
             "id":349,
             "mandatory":"Y"
          },
          {
             "id":348,
             "mandatory":"Y"
          }
       ]
    },
    {
       "id":3,
       "name":"PI",
       "creator":"IBM",
       "version":2,
       "isLatest":"Y",
       "description":"test version description",
       "createdUserId":"jdbcusr1",
       "modifiedUserId":"jdbcusr1",
       "createdTimestamp":"2025-02-10 09:27:49",
       "modifiedTimestamp":"2025-02-10 09:27:49",
       "dataClasses":[
          {
             "id":355,
             "mandatory":"Y"
          },
          {
             "id":349,
             "mandatory":"Y"
          },
          {
             "id":348,
             "mandatory":"Y"
          }
       ]
    }
 ],
 "count":2
}
```

--------------------------------

### GET Classification Scheme by Name, Version, Creator (API Response)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=csa-get

Example JSON response when successfully retrieving a classification scheme by its specific identifiers. Includes status, message, and the detailed object of the requested scheme.

```JSON
{
 "code":200,
 "status":"SUCCESS",
 "message":"Classification scheme fetched successfully.",
 "timestamp":"2025-01-13 18:35:15",
 "data":[
    {
       "id":28,
       "name":"PI",
       "creator":"IBM",
       "version":1,
       "isLatest":"Y",
       "description":"Add a new classification",
       "createdUserId":"jdbcusr1",
       "modifiedUserId":"jdbcusr1",
       "createdTimestamp":"2025-01-12 12:44:15",
       "modifiedTimestamp":"2025-01-12 12:44:15",
       "dataClasses":[
          {
             "name":"Email Address",
             "version":1,
             "mandatory":"Y"
          }
       ]
    }
 ]
}
```

--------------------------------

### Start IBM Security Center for Z Restore Container

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=configuration-steps-backup-restore

Launches a Docker container to restore IBM Security Center for Z from a backup. This command mounts volumes and uses an environment file. Replace <version> with the appropriate release version.

```bash
docker run -dt --name zscc-compose-container -v /var/run/docker.sock:/var/run/docker.sock -v zscc-tls-certs:/opt/cloud-gov/certs -v zscc-backup-volume:/opt/cloud-gov/backup --env-file <absolute path to zscc.config file> icr.io/ibmz-scz/compliance-compose:<version> bash
```

--------------------------------

### Backup Compliance Database - `oc` and `pg_dumpall`

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=guide-back-up-critical-resources-manual-steps

Connects to the `postgres-0` pod and creates a compressed backup of the PostgreSQL compliance database using `pg_dumpall`. The output is saved to `postgres.sql.gz`.

```bash
oc exec postgres-0 -c postgres-container -- pg_dumpall -U postgres | gzip >postgres.sql.gz
```

--------------------------------

### Remove Existing Compose Container (Docker)

Source: https://www.ibm.com/docs/en/zsecure-compliance/latest_topic=isizcezc-install-scz-in-zos-container-extensions-zcx-configuration

Removes a pre-existing compose container to avoid conflicts during a new deployment. This is a prerequisite before starting a new compose container.

```bash
docker rm zscc-compose-container
```

--------------------------------

### Update SCZ Configuration File

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=isizcezc-install-scz-in-zos-container-extensions-zcx-configuration

Example variables to be added or updated in the `zscc.config` file to point to the internal container registry. This includes registry address, username, and password.

```configuration
REGISTRY_ADDRESS=<internal-registry.com>
DOCKER_USERNAME=<internal-registry-username>
DOCKER_PASSWORD=<password-of-internal-registry-username>
```

--------------------------------

### GET All Scan Results with Pagination

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=sra-get

This endpoint allows users to retrieve scan results with pagination. It accepts 'offset' and 'limit' as parameters to specify the starting point and the number of records to return, respectively. The API returns a list of scan results or an error message if no results are found.

```HTTP
GET /sdtz/v1/scan-result?offset=1&limit=10
```

```JSON
{
    "status": "SUCCESS",
    "code": 200,
    "message": "Scan results fetched successfully",
    "timestamp": "2024-11-15 12:34:56",
    "data": [
        {
            "id": 25,
            "runId": "76LBDQZV",
            "dataObjectId": 4,
            "scanRequestName": "Db2 scan",
            "scanVersion": 3,
            "sensitivity": "SENSITIVE       ",
            "sysplexName": "",
            "idFromSubSystem": "270.3",
            "lparName": "",
            "dataObjectType": "DB2",
            "dataObjectName": "SYNTHDATA.USERS",
            "classificationTime": "2025-07-24 09:10:29"
        },
        {
            "id": 3,
            "runId": "PSA9XFYB",
            "dataObjectId": 3,
            "scanRequestName": "Catalog Users",
            "scanVersion": 1,
            "sensitivity": "SENSITIVE       ",
            "sysplexName": "sysplex",
            "idFromSubSystem": "270.3",
            "lparName": "lpar",
            "dataObjectType": "DB2",
            "dataObjectName": "SYNTHDATA.USERS",
            "classificationTime": "2025-07-20 19:52:40"
        },
        {
            "id": 4,
            "runId": "S20KV4V7",
            "dataObjectId": 3,
            "scanRequestName": "Catalog Users",
            "scanVersion": 1,
            "sensitivity": "SENSITIVE       ",
            "sysplexName": "sysplex",
            "idFromSubSystem": "270.3",
            "lparName": "lpar",
            "dataObjectType": "DB2",
            "dataObjectName": "SYNTHDATA.USERS",
            "classificationTime": "2025-07-20 20:06:58"
        },
        {
            "id": 5,
            "runId": "11U7G5VP",
            "dataObjectId": 3,
            "scanRequestName": "Catalog Users",
            "scanVersion": 1,
            "sensitivity": "SENSITIVE       ",
            "sysplexName": "sysplex",
            "idFromSubSystem": "270.3",
            "lparName": "lpar",
            "dataObjectType": "DB2",
            "dataObjectName": "SYNTHDATA.USERS",
            "classificationTime": "2025-07-21 06:22:03"
        }
    ],
    "count":4
}
```

```JSON
{
        "status": "FAILURE",
        "code": 404,
        "message": "No scan results found.",
        "timestamp": "2024-11-15 12:34:56"
 }
```

--------------------------------

### Run Shell Script to Set Up Working Directory

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=tool-setting-up-working-directory-configuration

Executes the 'savingpolicy.sh' script to set up the necessary directory structure and configuration files for z/Secure Compliance. Ensure the /tmp directory has at least 1 MB of free space before running this script. The script creates symbolic links and configuration files required by the Configuration Tool.

```shell
sh /usr/lpp/IBM/zcdp/v5r1m0/UI/LIB/savingpolicy.sh
```

--------------------------------

### GET Data Classes with Pagination

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=dca-get

Retrieves a subset of data classes based on specified offset and limit parameters. The 'offset' parameter is mandatory and indicates the starting point, while 'limit' is optional and defaults to 10, defining the maximum number of records to return. An error is returned if the offset results in no records.

```HTTP
/sdtz/v1/data-class?offset=2&limit=1
```

```JSON
{
 "status": "SUCCESS",
 "code": 200,
 "message": "Data class fetched successfully",
 "timestamp": "2024-11-15 12:34:56",
 "data": [
 {
 "id": "3",
 "name”: " Email address",
 "description": "An email address identifies the box to which email messages are delivered.",
 "alias": [ “EA”, “EmailAddress”],
 "version": 1,
 "createdUserId" : "XXXXXX",
 “modifiedUserId” : “YYYYYY”,
 "createdTimestamp": "2024-07-23 07:43:02",
 "modifiedTimestamp": "2024-07-23 07:43:02"
 }
 ],
 "count": 2
}

```

```JSON
{
 "status": "FAILURE",
 "code": 404,
 "message": "No data classes found.",
 "timestamp": "2024-11-15 12:34:56",
 "data":[]
}

```

--------------------------------

### Generate Server Private Key for Self-Signed Certificate

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=isizcezc-install-scz-in-zos-container-extensions-zcx-configuration

Creates a server private key using RSA encryption with a key length of 4096 bits. This key will be used to sign the server certificate in a self-signed setup.

```bash
openssl genrsa -out server.key 4096
```

--------------------------------

### Copy Keystore File from Controller Pod - `oc cp`

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=guide-back-up-critical-resources-manual-steps

Copies the keystore file from the IBM Security Center for Z controller pod to the current local directory. It dynamically finds the controller pod using a label selector.

```bash
oc cp $(oc get pods --selector=tier=scc-controller --output=name |  grep -o '[^/]*$'):keystores/keystore ./keystore
```

--------------------------------

### Set CPREFIX Variable for z/OS Compliance Integration Manager (JCL)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=task-installation-compliance-evidence

Example JCL statements to export and set the &CPREFIX variable, which is used by the z/OS Compliance Integration Manager and the IBM Z Security and Compliance Center. This variable points to the zSecure configuration data set.

```JCL
//  EXPORT SYMLIST=*
//  SET CPREFIX=CKR.ZSCC
```

--------------------------------

### Modify Compliance Evidence Task Status

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=task-operation-compliance-evidence-started

This example shows how to use the MODIFY or F command to interact with an active Compliance Evidence started task. The DISPLAY command retrieves the current status and active options. Ensure the command following the comma is a supported operator command.

```Operator Command
MODIFY CKCS1154,DISPLAY
```

```Operator Command
F CKCS1154,DISPLAY
```

--------------------------------

### Create SDTz GUI Docker Service

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=zcx-deploying-sensitive-data-tagging-z

This command creates and configures the SDTz GUI Docker service. It specifies the service name, mounts necessary secrets and volumes, sets environment variables for backend communication and UI port, configures networking and port publishing, and defines resource limits and restart policies. The image used is `icr.io/ibm-zsc/<image-name:tag>`.

```bash
docker service create \
--name SDTz-gui-container \
--secret sdtz_tls_cert \
--secret sdtz_ca_cert \
--secret sdtz_tls_private_key \
--env SSL_CERT_FILE=/run/secrets/sdtz_ca_cert \
--env SSL_CERT_DIR=/run/secrets/ \
--env BACKEND_HOST=<zCX hostname> \
--env BACKEND_PORT=<core host port> \
--env BACKEND_SERV=SDTz-core-container \
--env NGINX_PORT=<ui-port> \
--mount type=volume,source=sdtz_config_volume,target=/sdtzapp/config \
--mount type=volume,source=sdtz_logs_volume,target=/sdtzapp/logs \
--network sdtz_net \
--publish <host-port:container-port>  \
--detach \
--ulimit nproc=5000:5000 \
--ulimit nofile=8192:65536 \
--restart-max-attempts=5 \
--restart-delay 10s \
icr.io/ibm-zsc/<image-name:tag>
```

--------------------------------

### OpenShift Commands for Namespace Cleanup and Creation

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=guide-restoring-from-backup-manual-steps

Commands to remove the existing IBM Security Center for Z namespace and create a new one. This is the initial step in the restore process to ensure a clean environment.

```bash
oc delete -f zscc-deployment.yaml
oc new-project ibmz-scc
```

--------------------------------

### OpenShift Command to Copy Keystore File

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=guide-restoring-from-backup-manual-steps

Command to copy a local keystore file to the controller pod's mount point. It identifies the controller pod using a label selector and copies the file to the '/keystores/keystore' path within the pod.

```bash
oc cp ./keystore $(oc get pods --selector=tier=scc-controller --output=name |  grep -o '[^/]*$'):keystores/keystore
```

--------------------------------

### Example User DN (Distinguished Name)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=integration-adding-ldap-connection

An example of a full distinguished name (DN) for a user within an LDAP directory. This format is crucial for locating user entries within the LDAP tree.

```text
CN=users,DC=example,DC=com
```

--------------------------------

### Create Shutdown Configuration File

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=configuration-steps-upgrade-restart-shutdown

Creates the `shutdown.config` file using the `cat` command with a here-document. This file specifies the DEPLOYMENT_MODE, DOCKER_VERSION, and GROUP_ID for the shutdown process. Ensure correct values are substituted for your environment.

```bash
cat >> shudown.config << EOL
DEPLOYMENT_MODE=shutdown
DOCKER_VERSION=1.41
GROUP_ID=109
EOL
```

--------------------------------

### Install SMF IEFU86 User Exit (MVS Commands)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=uzcdpfv15-upgrading-smf-user-exit-collecting-smf-records-from-z-common-data-provider-version-110-510

These MVS commands are used to install the SMF IEFU86 user exit. This includes adding the exit for the system and, if applicable, for specific subsystems.

```MVS
SETPROG EXIT,ADD,EXITNAME=SYS.IEFU86,MODNAME=HBOSMF86
```

```MVS
SETPROG EXIT,ADD,EXITNAME=SYSSTC.IEFU86,MODNAME=HBOSMF86
```

--------------------------------

### Example Bind DN (Distinguished Name)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=integration-adding-ldap-connection

An example of a distinguished name (DN) for an administrator or service account used for authentication during the LDAP bind operation. This DN allows the system to access LDAP information.

```text
CN=Administrator,CN=Users,DC=demo,DC=example,DC=com
```

--------------------------------

### Enable System Data Engine Tracing at Startup (JCL)

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=data-enabling-tracing-system-engine-startup

This JCL snippet shows how to enable tracing for the System Data Engine at startup by modifying the HBOIN DD statement. It requires adding the DEBUG LEVEL command, with the specific level provided by IBM Software Support. Tracing output is directed to the HBODEBUG or HBODUMP dataset.

```JCL
//HBOIN    DD *
               DEBUG LEVEL
               ...
```

```JCL
//HBODEBUG  DD SYSOUT=*

```

--------------------------------

### Tivoli RACF LDAP Filter Example

Source: https://www.ibm.com/docs/en/zsecure-compliance/latest_topic=integration-adding-ldap-connection

This example demonstrates how to construct a custom LDAP filter string for importing users from a Tivoli RACF database into Keycloak. It specifically shows how to filter users based on their group membership.

```ldap
(racfconnectgroupname=RACFID=<racf_group_id>,PROFILETYPE=GROUP,O=RACF)
```

--------------------------------

### Example Authorization Header

Source: https://www.ibm.com/docs/en/zsecure-compliance/3.2_topic=api-put

This header provides an example of an access token used for authenticating requests to the Classification Scheme API. The `access_token` should be replaced with a valid token.

```http
- Set-Cookie: access_token=abc123hj90ghftyfg8900hj890bjkjk890h HttpOnly; Secure; SameSite=None
```
Tokens:
Raw