PCI-DSS Deployment Guide – Configure the Module

LogRhythm requires that you configure some objects included in the PCI-DSS 3.2 Compliance Automation Suite. This section describes the steps you must perform.

Intelligent Indexing

Intelligent Indexing allows Reports, Investigations, and Tails to keep the appropriate log data online in the Log Manager/Data Processor. Care must be taken when choosing which object to allow Intelligent Indexing as broad criteria can cause an exceptional amount of online data and overwhelm the Log Manager/Data Processor. For a list of Intelligent Indexing-capable objects and their recommended settings, see the matrices available from the home page of this module.

Population of Lists

The PCI-DSS 3.2 Compliance List must be populated with the data you collected before installing the module. Complete the following sections to populate all required lists.

Populate Log Source Lists

1. Open the LogRhythm Console and click List Manager.
2. Right-click the name of a PCI-DSS 3.2 Log Source List, and then click Properties.
3. To view the log sources selector, click Add Item.
4. Search for and select all log sources that you want, and then click OK.
5. To save the list, click OK.
6. Repeat this process (steps 1-5) for all PCI-DSS 3.2 Log Source Lists from your checklist.

Populate Users Lists

1. Open the LogRhythm Console and click List Manager.
2. Right-click the name for a PCI-DSS 3.2 Users List, and then click Properties.
3. Select the Username for the Item Type.
4. Type in the username in the Add Item field.
5. Click Add Item to add the username.
6. Repeat steps 4-5 to for all usernames.
7. To save the list, click OK.
8. Repeat this process (steps 1-7) for all PCI-DSS 3.2 Users Lists.

Populate Default Privileged Group List

1. Open the LogRhythm Console and click List Manager.
2. Right-click the PCI-DSS 3.2: Default Privileged Group list, and then click Properties.
3. Click the List Items tab.

4. Type any privilege group designation within your environment within the Add Item text field, and then click Add Item.

   

   This list comes pre-populated with fourteen (14) default privileged groups but can be customized according to the organization’s environment.

5. To save the list, click OK.

Populate Network Lists

1. Open the LogRhythm Console and click List Manager.
2. Right-click the name for a PCI-DSS 3.2 Network List, and then click Properties.
3. Click the List Items tab.
4. Click the Add Item tab.
5. Select he appropriate Networks, and then click OK to add.
6. Repeat steps 4-5 to for all networks you want.
7. To save the list, click OK.
8. Repeat this process (steps 1-7) for all PCI-DSS 3.2 Networks Lists.

Populate Application Lists

1. Open the LogRhythm Console and click List Manager.
2. Right-click the name for a PCI-DSS 3.2 Application List, and then click Properties.
3. Click the List Items tab.
4. Click the Add Item tab.
5. Select the appropriate Applications in the Service/Program Selector, and then click OK.
6. Repeat steps 4-5 for all applications you want.
7. To save the list, click OK.
8. Repeat this process (steps 1-7) for all PCI-DSS 3.2 Applications Lists.

Activate and Configure AIE Rules

All AIE Rules included in the PCI-DSS 3.2 Compliance Automation Suite are disabled by default.

1. Open the LogRhythm Console and click Deployment Manager.
2. Click the AI Engine tab.
3. Select all the PCI-DSS 3.2 AIE rules.
4. Right-click the AI Engine Rule Manager, click Actions, and then click Enable.

All alarming AIE Rules included in the PCI-DSS 3.2 Compliance Automation Suite have been alarmingly disabled by default.

1. Open the LogRhythm Console and click Deployment Manager.
2. Click the AI Engine tab.
3. Select all the  PCI-DSS 3.2 AIE rules that are configured to alarm.
4. Right-click the AI Engine Rule Manager, click Actions, click Batch Enable Alarms, and then click Enable Alarms.

All alarming AIE Rules included in the PCI-DSS 3.2 Compliance Automation Suite must be configured for notifications.

1. Open the LogRhythm Console and click Deployment Manager.
2. Click the AI Engine tab.
3. Select each of the PCI-DSS 3.2 AIE rules that are configured to alarm and notify.
4. Right-click the AI Engine Rule Manager, click Actions, and then click Batch Notification Editor.
5. Select all the roles, individuals, or groups to be notified, and then click OK to save the notifications.
6. Repeat Steps 2-5 for all alarming PCI-DSS 3.2 AIE Rules that share notification personnel.
7. On the top of the AI Engine Rule Manager, click Restart AIE Engine Servers.

Use of LogRhythm Network Monitor for TLS/SSL Auditing

For information on using Network Monitor to translate TLS and SSL traffic for review and analysis, see PCI-DSS User Guide—Network Monitor and TLS/SSL Auditing.