Methods, systems, and devices are described for monitoring and managing mainframe events. In the methods, systems, and devices of the present disclosure, a stream of messages at a mainframe management console may be monitored to detect mainframe events. The mainframe events may be filtered according to at least one predetermined filtering criterion to identify a plurality of selected mainframe events. The selected mainframe events may then be converted from a character encoding specific to the mainframe to a generic character encoding, and routed to at least one destination Security Information Event Manager (SIEM) application.