Documentation for PCI events?

[patricktownsend]

Hello,

Have searched community forum and developer area but haven't found resources for this. Is there documentation on how to create events that will be indexed into the Splunk PCI reports? The PCI reports are arranged in multiple sections and I would like to send events to the appropriate section. I imagine that there are name/value tags that can be used for this, but need some guidance. A pointer to documentation would be appreciated!

Thanks,
Patrick

[ChrisG · Accepted solution]

If you are using the Splunk App for PCI Compliance, the Installation and Configuration Manual contains instructions for each report that explain what data to index, how to map the data to the relevant Common Information Model fields, configure the report columns, and so on. See Reports in the Splunk App for PCI Compliance as the starting place.

[patricktownsend]

Thanks Chris, this is the reference I needed. I will need to spend some time understanding the Common Information Model fields.

[woodcock]

Are you using the free or paid app?

[patricktownsend]

Splunk Enterprise - paid app.