Defining and locating eventtypes in PCI app

[zliu]

In Splunk 4.1.4

***What happened:

tried to run the PCI 1.1.1 Network Changes report but it fails stating that eventtype=snmpd_network_down and eventtype=linux-password-change are missing. In investigating the issue, noticed the following.

tag=eventtype::network - Missing are eventtype=fschange_add_network, eventtype= fschange_modify_network, and eventtype=snmpd_network_down

tag=eventtype::modify - Missing are eventtype=auditd_modify, eventtype=configuration-change, eventtype=linux- password-change and linux-password-change-failed

tag=eventtype::configuration - Missing eventtype=configuration-change

tag=eventtype::policy - Is missing

***What is found:

It seems that those eventypes are all located at
$SPLUNK_HOME/etc/apps/unix/default/eventtypes.conf. They are under UNIX app.

***Questions:

How do I know which eventtypes needs to be defined under the PCI App? Or do I have to define all of them? Once I know which ones, what the best way to do this?

[zliu · Accepted solution]

This doesn't appear to be a problem with PCI, instead the UNIX app being used by the customer. Note that PCI is not compatible with the Splunk for Unix app and SKB-unix should be used instead. In general, the SKB's that we offer contain the proper eventtypes and tags to drive the PCI reports.

The report in question PCI 1.1.1 uses the following base search syntax to look for network changes: The errors that are being seen is a result of the unix app specifying one of these tags w/ missing eventtypes. If the customer believes they have data that qualifies as network change data but it's not showing up in the report, then the data is likely not being tagged appropriately.

tag=pci tag=eventtype::network tag=eventtype::modify (tag=eventtype::configuration OR tag=eventtype::policy)