Vulnerability Scan Details
Report on vulnerabilities discovered on PCI assets. This report looks at vulnerability scan details data produced by firewalls, routers, switches, and any other device that produces vulnerability data.
Vulnerability scans of the cardholder data environment expose potential vulnerabilities in networks that could be found and exploited by malicious individuals. When these weaknesses are identified, the organization should correct them and repeat the vulnerability scan to verify that they have corrected the vulnerabilities.
This report shows all vulnerabilities identified for selected assets. Use this report to identify specific high and/or critical vulnerabilities on cardholder systems that need to be fixed.
Relevant data sources
Relevant data sources for this report includes any vulnerability data.
How to configure this report
- Index vulnerability scan results in Splunk platform.
- Map the vulnerability data to the following Common Information Model fields:
category,severity,signature,dest,os. If you want, you can map additional fields.
cve, bugtraq, cert, msft, mskb, xref, cvss.
- Tag the successful synchronization data with "vulnerability" and "report".
The data in the Vulnerability Scan Details report is populated by the Vulnerabilities data model.
Useful searches for troubleshooting
|Troubleshooting Task||Search/Action||Expected Result|
|Verify that you have data from your network devices.||sourcetype=<expected_st>||Returns data from your network devices.|
|Verify that vulnerability data is in Splunk platform.||tag=vulnerability tag=report
|Returns vulnerability data.|
|Verify that fields are normalized and available at search time.||`vulnerability` | table _time,dest,category,signature,cve,bugtraq,cert,msft,
|Returns a table of the vulnerability data fields.|
PCI Asset Logging
Rogue Wireless Access Point Protection
This documentation applies to the following versions of Splunk® App for PCI Compliance: 5.0.1, 5.0.2, 5.1.0, 5.1.1, 5.1.2, 5.2.0