Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- File Integrity Monitoring PCIDSS
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
File Integrity Monitoring PCIDSS
Hi All, has anyone using Splunk as a file integrity monitoring system for PCIDSS? We currently use a fantastic product called Tripwire however the cost is exorbitant and I'm looking to find an alternative.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are using Tripwire Enterprise you may enjoy the new App for it.
Hot off the presses!
http://apps.splunk.com/app/1828/
1.0 version.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is an old thread but in case somebody stumples across this.
You don't want to use fschange and there are good reasons splunk discourages the use of fschange now.
Either use Tripwire or other FIM solutions or try to figure out how to do it with se-linux 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From consulting people I hear about Tripwire providing FIM and sending it to Splunk. Don't see Splunk used as the FIM provider - Splunk is better at other things, not FIM.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The point is though that it CAN do FIM, which often can be enough to make people happy.
The FIM functionality is now sadly being deprecated though, so it's hard to keep on recommending people to consider using Splunk for FIM.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear servebase - my company is actually the very first Splunk reseller - something we are very proud of and are very familiar with PCI-DSS 2.0 We have a comprehensive FIM function as part of our Reliant Security Splunk app that leverages a scheduled SSH stream that can be direected and configured centrally to monitor any file ot folder path. or more information please contact me directly at pstead@reliantsecurity.com
Sincerely,
Phil
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi servebase - Hopefully someone who actually uses it in this capacity will answer. In the meantime, I'll point out generally that we have lots of customers using our Universal Forwarder, which includes an FSChange monitor, to meet PCI requirement 11.5 (and possibly 10.5.5 depending on your environment). Our PCI Compliance solution (http://www.splunk.com/view/pci-compliance/SP-CAAACPS) includes built-in reports to use this information or consume data from Tripwire or other FIM solutions.
If you want more information on FSChange, check this out:
- http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/FSChangelocal
- http://docs.splunk.com/Documentation/Splunk/4.3.3/Data/Monitorchangestoyourfilesystem
Regards,
Jim
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon
[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions
Splunk Community Badges!
