CAISECMIB

Description: Provides CA Unicenter security management objects for monitoring access control, user authentication, and security policy compliance.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

CAISECMIB is a CA (Computer Associates) enterprise MIB, published under the CAIOPSMIB naming, that defines SNMP TRAP-TYPE notifications issued by CA-Security products — specifically CA-ACF2 and CA-Top Secret (CA-TSS) mainframe access-control systems — rather than polled OBJECT-TYPE data. Rooted under cai.caiSysMgt.caiSecurity (enterprises.791.2.3), it defines caiACF2AVT1/AVT2 (dataset and resource access violations), caiACF2PVT1 (password violation), and caiACF2USP1 (user suspension) for CA-ACF2, plus the parallel caiTSSAVT1/AVT2/AVT3 (volume, dataset, resource violations), caiTSSPVT1 (password violation), and caiTSSUSP1 (user suspension) for CA-TSS, each carrying a single DisplayString varbind (caiACF2LstMsg / caiTSSLstMsg) containing the vendor's formatted violation message text (LOGINID/ACID, jobname, source, access type, resource/dataset name, and product-specific return codes). This gives security operations teams a real-time trap feed of access-control and authentication violations on CA-managed MVS mainframe systems, which is the primary way to monitor security policy compliance and unauthorized access attempts through SNMP rather than log scraping. It depends only on standard RFC-1155-SMI/RFC-1212/RFC-1215 constructs and has no OBJECT-TYPE data tables of its own — everything is delivered via traps — and is deployed alongside CA-ACF2 and CA-Top Secret security software on IBM mainframe (MVS) environments. Mainframe security teams typically pull a CAISECMIB download to configure trap parsing rules in their SNMP manager.

A security operator's trap receiver captures a caiACF2AVT1 trap and parses its caiACF2LstMsg varbind for LOGINID, DSN, and ACCESS fields to identify which user attempted unauthorized access to a protected dataset; repeated caiACF2USP1 user-suspension traps for the same LOGINID in a short window would flag a likely brute-force or compromised-credential attempt worth investigating.

Computer Associates security MIB defining traps and events issued by CA-Security products and services.