Getting Data In

File Integrity Monitoring PCIDSS

servebase
New Member

Hi All, has anyone using Splunk as a file integrity monitoring system for PCIDSS? We currently use a fantastic product called Tripwire however the cost is exorbitant and I'm looking to find an alternative.

Tags (1)
0 Karma

JimWachhaus
Path Finder

If you are using Tripwire Enterprise you may enjoy the new App for it.

Hot off the presses!

http://apps.splunk.com/app/1828/

1.0 version.

0 Karma

flo_cognosec
Communicator

This is an old thread but in case somebody stumples across this.
You don't want to use fschange and there are good reasons splunk discourages the use of fschange now.
Either use Tripwire or other FIM solutions or try to figure out how to do it with se-linux 😉

0 Karma

kesty
New Member

From consulting people I hear about Tripwire providing FIM and sending it to Splunk. Don't see Splunk used as the FIM provider - Splunk is better at other things, not FIM.

0 Karma

Ayn
Legend

The point is though that it CAN do FIM, which often can be enough to make people happy.

The FIM functionality is now sadly being deprecated though, so it's hard to keep on recommending people to consider using Splunk for FIM.

phillipstead
New Member

Dear servebase - my company is actually the very first Splunk reseller - something we are very proud of and are very familiar with PCI-DSS 2.0 We have a comprehensive FIM function as part of our Reliant Security Splunk app that leverages a scheduled SSH stream that can be direected and configured centrally to monitor any file ot folder path. or more information please contact me directly at pstead@reliantsecurity.com

Sincerely,

Phil

www.reliantsecurity.com

0 Karma

jhansen
Splunk Employee
Splunk Employee

Hi servebase - Hopefully someone who actually uses it in this capacity will answer. In the meantime, I'll point out generally that we have lots of customers using our Universal Forwarder, which includes an FSChange monitor, to meet PCI requirement 11.5 (and possibly 10.5.5 depending on your environment). Our PCI Compliance solution (http://www.splunk.com/view/pci-compliance/SP-CAAACPS) includes built-in reports to use this information or consume data from Tripwire or other FIM solutions.

If you want more information on FSChange, check this out:

Regards,
Jim

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...