The CLIP software product provides services in BS2000 for integrating security-relevant messages and events from the BS2000 system into a SIEM environment.
CLIP is a loadable subsystem in BS2000, part of the BS2000 OS DX package, and is available on current BS2000 servers.
The subsystem consists of a privileged component (TPR) and a non-privileged component (TU). The TU component is loaded by the Job Management System (JMS) when the subsystem is started, while the TPR component is managed by Dynamic Subsystem Management (DSSM).
To execute the program, a batch task of type TP with the job name CLIP is automatically started under the TSOS user ID. This task runs in the background as a daemon.
Main tasks of the TPR component:
- Preparing the execution of the TU component
- Establishing and managing a FITC connection with the TU component
- Receiving interface calls from privileged tasks and transferring them to non-privileged memory
- Communicating with the operator via console messages
Main tasks of the TU component:
- Communicating with the CLIP subsystem (TPR) and receiving messages transmitted from it
- Parsing and processing the incoming messages
- Forwarding the processed messages to a Syslog server, such as an rSyslog server
The current required product versions and patch levels necessary for operation can be found in the latest BS2000 OS DX release notice.