How this app works with Splunk Enterprise Security

The Splunk App for PCI Compliance and Splunk Enterprise Security use the same framework and share certain components so that they work together without duplicating efforts.

• Install the Splunk App for PCI Compliance (for Splunk Enterprise) when Splunk Enterprise Security is not pre-installed in your environment. The Splunk App for PCI Compliance (for Splunk Enterprise) includes the Splunk Enterprise Security framework to provide functionality such as correlation searches, notable events, asset and identity correlation, and others. The Splunk App for PCI Compliance (for Splunk Enterprise) creates indexes and data model accelerations in the same way as Splunk Enterprise Security. This content pack automatically installs Splunk Enterprise Security. Therefore, ensure that Splunk Enterprise Security is not pre-installed in your Splunk instance for a smooth installation process.

• Install the Splunk App for PCI Compliance (for Splunk Enterprise Security) when Splunk Enterprise Security is pre-installed in your environment. The Splunk App for PCI Compliance (for Splunk Enterprise Security) functions as an add-on with Splunk Enterprise Security and uses the same indexes, data models, and framework as Splunk Enterprise Security. If you have Splunk Enterprise Security in your deployment, install the Splunk App for PCI Compliance (for Splunk Enterprise Security).

For specifics about what you install and where, see Install prerequisites.