Splunk Enterprise Security

PCI Compliance 11.5 - Monitoring files for changes

sf_user_199
Path Finder

We are using Splunk to implement file integrity monitoring, but our security team has a requirement that I'm having trouble implementing.

For monitoring file integrity, we are using fschange. For monitoring /var/log and other items we are using 'monitor'. We have SSL between Splunk forwarder & indexer, as well as event hashing on key log sources.

The scenario, however, that I need to detect is this:

  • Splunk monitors /var/log/messages
  • Splunk uses fschange to perform FIM on /etc/*
  • Bad actor accesses server, and edits /etc/hosts
  • Bad actor accesses server, and removes log lines from /var/log/messages (assume file is already indexed by splunk)

FSchange will notify that the file was edited - but how do we detect that log lines were removed from the log file?

I've tried using send full event in FSchange, but that just re-indexes the entire file.

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It doesn't matter that the lines were removed from the file. The point is, the data has been moved off. You don't use the file to review logs, you use Splunk. It's obviously pointless to try to monitor when a log file has been modified or truncated, since that is both routing and inherent in the nature of a log file. The PCI requirements can be read as requiring this, but it's not a reasonable reading. The purpose of sending the log data away is precisely to make an unauthorized change irrelevant.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

It doesn't matter that the lines were removed from the file. The point is, the data has been moved off. You don't use the file to review logs, you use Splunk. It's obviously pointless to try to monitor when a log file has been modified or truncated, since that is both routing and inherent in the nature of a log file. The PCI requirements can be read as requiring this, but it's not a reasonable reading. The purpose of sending the log data away is precisely to make an unauthorized change irrelevant.

sf_user_199
Path Finder

Thank you - this is very close the discussion we've already had regarding this requirement.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...