topic Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements in Cortex XDR Discussions

Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Piotr_Kowalczyk — Tue, 23 May 2023 09:18:44 GMT

Hi,

I’ve read in https://isacala.org/wp-content/uploads/2020/08/Cortex-XDR-Whitepaper_Coalfire.pdf that the PCI-DSS compliance with 10.5.5 and 11.5 can be achieved with BIOC rules. Unfortunately, there is no details. Has anybody done this and can share knowledge/experience with me?

Thank you

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

jruck — Tue, 23 May 2023 14:44:42 GMT

I did create a File Integrity Monitoring rule for PCI that monitors our POS program files for any file action not performed by the POS program exe. Not sure if it would actually pass PCI audit though.

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Piotr_Kowalczyk — Thu, 25 May 2023 08:27:32 GMT

Hi Jruck,

Thanks you for the reply.

Unfortunately I don't think this meets PCI-DSS requirements which I'm referring to. They want us to monitor unauthorised logs and system files changes so it probably needs to be way more complex...

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

danlav — Wed, 15 Nov 2023 23:52:33 GMT

Hi Piotr!

Were you able to meet the requirement 11.5 (or part of this) with Cortex XDR BIOC?

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Piotr_Kowalczyk — Fri, 17 Nov 2023 09:34:03 GMT

Hi Dan,

Yes, it required a lot of work as I had to design and create BIOC rules myself but once is set, it is working well.

The hardest part was to find what to monitor. I used following: Track changes to system files and registry keys - Microsoft Defender for Cloud | Microsoft Learn + our important folders.

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

danlav — Wed, 22 Nov 2023 21:45:54 GMT

Hi Piotr, Thank you so much!

Re: Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

Piotr_Kowalczyk — Tue, 06 Aug 2024 11:28:44 GMT

Step by step instruction how to achieve this:

Cortex XDR File Integrity Monitoring for PCI-DSS