Monitoring Splunk

How to optimize Splunk for PCI Compliance?

JimSchlaker
New Member

Has anyone developed guidelines for what should be (and should not be) logged in Splunk for PCI Compliance audits? Referring specifically to the storage and data management requirements as described in the Information Security Forum (ISF) Standard of Good Practice (SoGP), the Payment Card Industry Data Security Standard (PCI DSS), ISO 27001, and US National Institute for
Standards and Technology (NIST) Cybersecurity Framework. We don't want to "log everything" so I'm curious if there are best practices regarding what to log - e.g., log data related to ABC requirements because Splunk processing is needed, but data related to XYZ requirements can be logged elsewhere because Splunk processing is not needed. Any help and guidance is greatly appreciated.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check out the free Splunk App for PCI Compliance at https://splunkbase.splunk.com/app/1143/.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JimSchlaker
New Member

Thanks for the link to the PCI Compliance app. The app appears to be worthwhile in this scenario: "Now that we have logged everything in Splunk, use the app determine overall compliance and gaps". But we're not interested in logging everything to Splunk. Instead we're curious to hear best practices regarding what is valuable to log in Splunk (i.e. Splunk is the best place for it because Splunk adds value in meeting PCI DSS audit/storage requirements) versus what is not valuable in Splunk (i.e., don't waste your ingestion license because Splunk adds no value in helping to meet PCI DSS audit/storage requirements). Any thoughts on this topic are greatly appreciated.

0 Karma

cly
New Member

The PCI Compliance App is far from free; several hundred thousand dollars.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You don't have to use the PCI Compliance app, but it can give ideas about how Splunk can help monitor compliance. See what indicators the app provides, decide which ones are important to you, then log the data needed for those indicators. You can even build your own dashboard(s) using that data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

rajneeshc1981
Explorer

I want to do pci but not through app, can you tell me what are best practices in Splunk to make logs pci compliance .

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...