BMC AMI Security

BMC AMI Security is BMC Software’s mainframe security monitoring and event-correlation product family, aimed at getting IBM z/OS security events (RACF, CICS, Db2, DFSMS access attempts and failures) into the same real-time view as an organization’s distributed-systems SIEM. Its lineage traces to CorreLog, an independent SIEM vendor that built its zDefender product specifically to solve a persistent enterprise problem: mainframe security data traditionally lives in its own silo, disconnected from the SIEM and SOC tooling that monitors everything else. BMC acquired CorreLog in October 2018 and has since folded its mainframe capabilities into the BMC AMI Security line, while continuing to sell most of CorreLog’s Windows/Unix distributed products separately.

The current product family includes BMC AMI Command Center for Security (dashboards and SIEM correlation across RACF/CICS/DFSMS/Db2 events), BMC AMI Datastream (real-time delivery of mainframe access data to distributed SIEM platforms such as Splunk, IBM QRadar, and LogRhythm), and BMC AMI Defender (automated configuration-vulnerability scanning based on real-world penetration-test findings). This gives security teams a way to treat the mainframe as a first-class citizen in enterprise-wide threat detection and compliance reporting rather than a system they audit separately once a quarter.

Because this profile covers a specific product line inside BMC — a large, diversified enterprise software company whose broader business spans IT service management, automation, and mainframe modernization well beyond security — the scoring here is scoped to the mainframe security/SIEM capability itself rather than to BMC as a whole. For CISOs running z/OS environments, the practical value is straightforward: it closes a well-known, long-standing blind spot between mainframe and distributed security monitoring.