Monitoring Splunk

How to optimize Splunk for PCI Compliance?

New Member

Has anyone developed guidelines for what should be (and should not be) logged in Splunk for PCI Compliance audits? Referring specifically to the storage and data management requirements as described in the Information Security Forum (ISF) Standard of Good Practice (SoGP), the Payment Card Industry Data Security Standard (PCI DSS), ISO 27001, and US National Institute for
Standards and Technology (NIST) Cybersecurity Framework. We don't want to "log everything" so I'm curious if there are best practices regarding what to log - e.g., log data related to ABC requirements because Splunk processing is needed, but data related to XYZ requirements can be logged elsewhere because Splunk processing is not needed. Any help and guidance is greatly appreciated.

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Check out the free Splunk App for PCI Compliance at https://splunkbase.splunk.com/app/1143/.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thanks for the link to the PCI Compliance app. The app appears to be worthwhile in this scenario: "Now that we have logged everything in Splunk, use the app determine overall compliance and gaps". But we're not interested in logging everything to Splunk. Instead we're curious to hear best practices regarding what is valuable to log in Splunk (i.e. Splunk is the best place for it because Splunk adds value in meeting PCI DSS audit/storage requirements) versus what is not valuable in Splunk (i.e., don't waste your ingestion license because Splunk adds no value in helping to meet PCI DSS audit/storage requirements). Any thoughts on this topic are greatly appreciated.

0 Karma

New Member

The PCI Compliance App is far from free; several hundred thousand dollars.

0 Karma

SplunkTrust
SplunkTrust

You don't have to use the PCI Compliance app, but it can give ideas about how Splunk can help monitor compliance. See what indicators the app provides, decide which ones are important to you, then log the data needed for those indicators. You can even build your own dashboard(s) using that data.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

I want to do pci but not through app, can you tell me what are best practices in Splunk to make logs pci compliance .

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!