How to optimize Splunk for PCI Compliance?

[JimSchlaker]

Has anyone developed guidelines for what should be (and should not be) logged in Splunk for PCI Compliance audits? Referring specifically to the storage and data management requirements as described in the Information Security Forum (ISF) Standard of Good Practice (SoGP), the Payment Card Industry Data Security Standard (PCI DSS), ISO 27001, and US National Institute for
Standards and Technology (NIST) Cybersecurity Framework. We don't want to "log everything" so I'm curious if there are best practices regarding what to log - e.g., log data related to ABC requirements because Splunk processing is needed, but data related to XYZ requirements can be logged elsewhere because Splunk processing is not needed. Any help and guidance is greatly appreciated.

[richgalloway]

Check out the free Splunk App for PCI Compliance at https://splunkbase.splunk.com/app/1143/.

[JimSchlaker]

Thanks for the link to the PCI Compliance app. The app appears to be worthwhile in this scenario: "Now that we have logged everything in Splunk, use the app determine overall compliance and gaps". But we're not interested in logging everything to Splunk. Instead we're curious to hear best practices regarding what is valuable to log in Splunk (i.e. Splunk is the best place for it because Splunk adds value in meeting PCI DSS audit/storage requirements) versus what is not valuable in Splunk (i.e., don't waste your ingestion license because Splunk adds no value in helping to meet PCI DSS audit/storage requirements). Any thoughts on this topic are greatly appreciated.

[cly]

The PCI Compliance App is far from free; several hundred thousand dollars.

[richgalloway]

You don't have to use the PCI Compliance app, but it can give ideas about how Splunk can help monitor compliance. See what indicators the app provides, decide which ones are important to you, then log the data needed for those indicators. You can even build your own dashboard(s) using that data.

[rajneeshc1981]

I want to do pci but not through app, can you tell me what are best practices in Splunk to make logs pci compliance .