Configure Interesting Processes list

The PCI DSS requires that processes in the PCI domain be tracked. To report on systems that might be in violation of this requirement, solution administrators and compliance managers can populate a list to define interesting processes. You can use this information to determine violations.

View the list.

1. Select Configure > Data Enrichment > Lists and Lookups.
2. Click the "Interesting Processes" list. In the Lookup editor, the interesting Processes lookup file (interesting_processes.csv) appears.

app,dest,dest_pci_domain,is_required,is_prohibited,is_secure,note

telnetd,*,*,false,true,false,The telnet application is prohibited because of insecure authentication.

The first line in the file describes the fields in the file.

Field	Description	Example
app	The application that is the source of the activity.	Win32Time
dest	The host that is the destination of the activity.	* to match all hosts, or the host name (for example, "ACME_host_001")
dest_pci_domain	The source domain of of the activity.	cardholder
is_required	Should the given service be required to be running?	for example, true or false
is_prohibited	Is the service/traffic/port prohibited?	for example, true or false
is_secure	Is the traffic for the given service encrypted?	for example, true or false
note	This can be whatever the user wants.

Add to or modify this list using the editor. Click Save when you are done.

There is no file checking or verification for this editor, so any typo might break the lookup file.