PCI Compliance 11.5 - Monitoring files for changes

[sf_user_199]

We are using Splunk to implement file integrity monitoring, but our security team has a requirement that I'm having trouble implementing.

For monitoring file integrity, we are using fschange. For monitoring /var/log and other items we are using 'monitor'. We have SSL between Splunk forwarder & indexer, as well as event hashing on key log sources.

The scenario, however, that I need to detect is this:

• Splunk monitors /var/log/messages
  
• Splunk uses fschange to perform FIM on /etc/*
• Bad actor accesses server, and edits /etc/hosts
• Bad actor accesses server, and removes log lines from /var/log/messages (assume file is already indexed by splunk)

FSchange will notify that the file was edited - but how do we detect that log lines were removed from the log file?

I've tried using send full event in FSchange, but that just re-indexes the entire file.

[gkanapathy · Accepted solution]

It doesn't matter that the lines were removed from the file. The point is, the data has been moved off. You don't use the file to review logs, you use Splunk. It's obviously pointless to try to monitor when a log file has been modified or truncated, since that is both routing and inherent in the nature of a log file. The PCI requirements can be read as requiring this, but it's not a reasonable reading. The purpose of sending the log data away is precisely to make an unauthorized change irrelevant.

[sf_user_199]

Thank you - this is very close the discussion we've already had regarding this requirement.