)SEC—Event Specifier of SEC Rules

Coding Each AOF Rule Type › Security Rules › )SEC—Event Specifier of SEC Rules

)SEC—Event Specifier of SEC Rules

Use this format for coding the security-event definition section:

)SEC facility||eventqualifier

facility

Specifies a CA OPS/MVS facility. This security-event specifier is one of the following character strings:

AP: The ADDRESS AP host environment, used to restrict commands sent to CA Automation Point.
OPSAOF: An ADDRESS AOF host command issued in an OPS/REXX program.
OPSBRW: The OPSBRW command processor, used to view entries in the OPSLOG Browse facility.
OPSCMD: The OPSCMD command processor or OPS/REXX ADDRESS OPER command, used to issue operator commands.
OPSCTL: The ADDRESS OPSCTL host environment, used to control the Multi-System Facility (MSF).
OPSDOM: The OPSDOM command processor, used to delete an outstanding message.
OPSEPI: An ADDRESS EPI host command issued from in an OPS/REXX program.
OPSGLOBAL: An OPS/REXX global variable that is accessed or updated.
OPSHFI: The OPSHFI command or REXX function, used to read, write, or delete variable records from the shared VSAM file supporting global variables.
OPSLOG: A CA OPS/MVS API request (processed by the CA OPS/MVS Automation Analyzer).
OPSOSF: An ADDRESS OSF, ADDRESS OSFTSL, or ADDRESS OSFTSP host command issued from within an OPS/REXX program.
OPSPARM: The OPSPARM command processor or the OPSPRM OPS/REXX function, used to change CA OPS/MVS parameter values.
OPSREPLY: The OPSREPLY command processor, used to reply to WTOR messages.
OPSREQ: The OPSREQ command processor, used to invoke AOF request rules.
OPSRMT: The OPSRMT command processor, used to issue a command to a remote system.
OPSSMTBL: The OPSSMTBL command processor, used to maintain the directory table that System State Manager uses to manage tables containing system resource information.
OPSVIEW: The OPSVIEW command processor, used to invoke
the CA OPS/MVS OPSVIEW interface.
OPSWTO: The OPSWTO command processor or the ADDRESS WTO host environment, used to send WTO or WTOR messages.
SOF: The ADDRESS SOF host environment, used to access the Switch Operations Facility (SOF) for managing the I/O configuration.
SQL: The OPSQL command processor or the ADDRESS SQL host environment, used to issue Structured Query Language commands.
SUBSYSDSN: A CA OPS/MVS subsystem data set that is opened.
USS: An ADDRESS USS host command issued from within an OPS/REXX program.

eventqualifier

Specifies a subset of the facility security-event specifier. The value is a character string.

Follow these guidelines when specifying the eventqualifier value:

Concatenate the string with the facility string (no blanks between them).
For all facility values except OPSCMD and OPSGLOBAL, you can only specify a wildcard (*) character. For example,
```
)SEC OPSBRW*
```
or
```
)SEC OPSAOF*
```
For OPSCMD, you can specify OPSCMD* to execute on all OPSCMDs or optionally specify a full command verb to be more specific. For example,
```
)SEC OPSCMDMODIFY
```
This facility and eventqualifier combination in this security event definition would execute for any z/OS MODIFY (or short form F) command issued through the OPSCMD command processor.
For OPSGLOBAL, you can specify OPSGLOBAL* to execute on all OPS/REXX global variable updates, or optionally specify up to 41 characters of the global variable name, followed by the wildcard (*) character. For example,
```
)SEC OPSGLOBALGLOBAL1.VAR*
```
The facility and eventqualifier combination in this security event definition matches all global variables beginning with the GLOBAL1.VAR prefix.
Lowercase letters are acceptable, but the AOF converts them to uppercase for event testing.
You can specify an * for the event definition to process all facilities.