This report looks at prohibited services data produced by the
services_tracker lookup. It reports on systems with prohibited services installed and running. Compromises often happen because of unused or insecure service and ports on systems within the cardholder environment or systems that have a communication path to cardholder systems.
These services and ports can have known vulnerabilities. A security hardening policy should be defined that clearly defines what services and protocols are allowed to run on each system. Organizations should test those systems periodically to ensure that they are patched appropriately and unauthorized services are disabled.
Relevant data sources
How to configure this report
- Index process, service, or port data in Splunk platform.
- Map the data to the following Common Information Model fields. Map services fields to
dest, StartMode. Map process fields to
dest, process. Map port fields:
dest,dest_port,transport. CIM-compliant add-ons for these data sources perform this step for you.
- Configure the
is_prohibitedcolumn in the Interesting [ports|processes|ports] lists with any service, process, or port considered prohibited.
The data in the Prohibited Services report is populated by three services_tracker lookups. One lookup is generated by the
Endpoint - Local Processes Tracker - Lookup Gen saved search, a second by the
Endpoint - Services Tracker - Lookup Gen saved search, and the third by the
Endpoint - Listening Ports Tracker- Lookup Gen saved search. The `localprocesses_tracker`, `services_tracker` macros correlate process data with the asset and identity tables to pull in additional information.
This report includes three searches:
Endpoint - Local Processes - Lookup Gen,
Endpoint - Services Tracker - Lookup Gen, and
Endpoint - Listening Ports Tracker- Lookup Gen.
Review each lookup generating search to learn more about the search schedule and time range.
Useful searches for troubleshooting
|Troubleshooting Task||Search/Action||Expected Result|
|Verify that service, process, and/or port information has been indexed.||sourcetype=<expected_st>||Returns data from service, process, and/or port. For example, sourcetype=WMI:Service.|
|Verify that the service data has been normalized at search time correctly.|| sourcetype=“*Service” | table dest, StartMode
or `service` | table dest, StartMode
|Returns a table of all service events.|
|Verify that the process data has been normalized at search time correctly.||sourcetype="*:LocalProcess“ | table dest, process||Returns a table of local process data.|
|Verify that the port data has been normalized at search time correctly.|| tag=listening tag=port | table dest,dest_port,transport
or `listeningports` | table dest,dest_port,transport
|Returns a table of port data.|
|Verify that the service tracker file is getting created correctly.|| | inputlookup append=T services_tracker
|Returns data in the service tracker.|
|Verify that the process tracker file is getting created correctly.|| | inputlookup append=T services_tracker
or | `localprocesses_tracker`
|Returns local processes data.|
|Verify that the port tracker file is getting created correctly.|| | inputlookup append=T localprocesses_tracker
|Returns data in the port tracker.|
|Verify that the Interesting Services, Interesting Processes, and/or Interesting Ports lookups are populated with expected prohibited values.|| Open the lists in Configure > Data Enrichment > Lists and Lookups > Interesting [ ports | processes | services ] and verify that the
Tracker files for this report are located:
This documentation applies to the following versions of Splunk® App for PCI Compliance: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2