Splunk® App for PCI Compliance

Installation and Configuration Manual

This documentation does not apply to the most recent version of Splunk® App for PCI Compliance. For documentation on the most recent version, go to the latest release.

Malware Activity

This report looks at malware activity data on cardholder systems produced by antimalware solutions or any other device that produces malware activity data. It looks at data from IDS, IPS, and DLP systems, to provide visibility into potentially unauthorized transmissions of credit card data over the network or to unauthorized removable storage devices.

Use this report to identify the source of the transmission so it can be further investigated and fixed. The cardholder data environment should be monitored for unauthorized transmission of credit card data using IDS, IPS, and DLP based technologies. PCI requires that cardholder data be protected from unauthorized access or distribution.

Relevant data sources

Relevant data sources include alerts from IDS, IPS, or DLP solutions and alerts from the Luhn-based algorithm detection method implemented in the Splunk Enterprise Security framework and used by the Splunk App for PCI Compliance.

How to configure this report

Make sure the activity data you are monitoring conforms to the malware sections of the Common Information Model.

  1. Index malware activity data from antivirus software in Splunk platform.
  2. Map the data to the following Common Information Model fields: action, category, signature, dest, dest_nt_domain, user, file_name, file_path, file_hash. CIM-compliant add-ons for these data sources perform this step for you.
  3. Tag the activity data with "malware" and "attack".

Report description

The data in the Malware Activity report is populated by is populated by the Malware data model.

Useful searches for troubleshooting

Troubleshooting Task Search/Action Expected Result
Verify that data is present. tag=malware tag=attack Returns malware activity data.
Verify that fields are normalized and available as expected. `malware` | table _time,host,action,category,signature,dest,
dest_nt_domain,user,vendor_product
Returns a table of events and the specific malware activity fields for malware activity data.
Last modified on 25 October, 2016
Endpoint Product Versions   Malware Signature Updates

This documentation applies to the following versions of Splunk® App for PCI Compliance: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.8.1, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.3.0, 4.4.0, 4.4.1, 4.5.0 Cloud only, 4.6.0, 4.6.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters