All Apps and Add-ons

Defining and locating eventtypes in PCI app

zliu
Splunk Employee
Splunk Employee

In Splunk 4.1.4

***What happened:

tried to run the PCI 1.1.1 Network Changes report but it fails stating that eventtype=snmpd_network_down and eventtype=linux-password-change are missing. In investigating the issue, noticed the following.

tag=eventtype::network - Missing are eventtype=fschange_add_network, eventtype= fschange_modify_network, and eventtype=snmpd_network_down

tag=eventtype::modify - Missing are eventtype=auditd_modify, eventtype=configuration-change, eventtype=linux- password-change and linux-password-change-failed

tag=eventtype::configuration - Missing eventtype=configuration-change

tag=eventtype::policy - Is missing

***What is found:

It seems that those eventypes are all located at
$SPLUNK_HOME/etc/apps/unix/default/eventtypes.conf. They are under UNIX app.

***Questions:

How do I know which eventtypes needs to be defined under the PCI App? Or do I have to define all of them? Once I know which ones, what the best way to do this?

Tags (1)
1 Solution

zliu
Splunk Employee
Splunk Employee

This doesn't appear to be a problem with PCI, instead the UNIX app being used by the customer. Note that PCI is not compatible with the Splunk for Unix app and SKB-unix should be used instead. In general, the SKB's that we offer contain the proper eventtypes and tags to drive the PCI reports.

The report in question PCI 1.1.1 uses the following base search syntax to look for network changes: The errors that are being seen is a result of the unix app specifying one of these tags w/ missing eventtypes. If the customer believes they have data that qualifies as network change data but it's not showing up in the report, then the data is likely not being tagged appropriately.

tag=pci tag=eventtype::network tag=eventtype::modify (tag=eventtype::configuration OR tag=eventtype::policy)

View solution in original post

zliu
Splunk Employee
Splunk Employee

This doesn't appear to be a problem with PCI, instead the UNIX app being used by the customer. Note that PCI is not compatible with the Splunk for Unix app and SKB-unix should be used instead. In general, the SKB's that we offer contain the proper eventtypes and tags to drive the PCI reports.

The report in question PCI 1.1.1 uses the following base search syntax to look for network changes: The errors that are being seen is a result of the unix app specifying one of these tags w/ missing eventtypes. If the customer believes they have data that qualifies as network change data but it's not showing up in the report, then the data is likely not being tagged appropriately.

tag=pci tag=eventtype::network tag=eventtype::modify (tag=eventtype::configuration OR tag=eventtype::policy)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...