IBM Threat Detection for z/OS is a security analytics product that analyzes z/OS SMF dataset-access telemetry to detect anomalous access patterns, produces structured anomaly events for forensic retention, and exposes investigation views via a z/OSMF plug-in.
Published Oct 13, 2026
TDz's recent general availability indicates the product is relatively new in-market, so adoption may still be at an early stage compared with long-established SIEMs and mainframe ESM tooling.
| Starting Price | Not publicly listed (quote-based) | Not consistently publicly listed (often via contracts/partners) | Not public list pricing for ES; typically quote-based |
| Primary Use Case | z/OS dataset access anomaly detection using SMF/z/OSMF; IBM Z security-centric teams | Mainframe-focused security monitoring programs seeking a broad mainframe security framework | Enterprises seeking cross-platform SIEM correlation and a large content ecosystem |
| Key Strength | Mainframe-native telemetry pipeline (SMF98 input, SMF83 anomaly record) and z/OSMF UI | Mainframe security specialization; framework content oriented to mainframe attack techniques | Broad ecosystem, correlation, detection engineering flexibility, many integrations |
| Key Weakness | Limited independent validation / limited public peer reviews; unclear integration story beyond SMF | May require significant tuning and integration into SOC tooling; pricing opacity | Complexity and cost; requires strong SIEM engineering/operations |
—