Cortex XDR File Integrity Monitor and PCI-DSS 10.5.5 and 11.5 requirements

[Piotr_Kowalczyk]

Hi,

I’ve read in https://isacala.org/wp-content/uploads/2020/08/Cortex-XDR-Whitepaper_Coalfire.pdf that the PCI-DSS compliance with 10.5.5 and 11.5 can be achieved with BIOC rules. Unfortunately, there is no details. Has anybody done this and can share knowledge/experience with me?

Thank you

[jruck]

I did create a File Integrity Monitoring rule for PCI that monitors our POS program files for any file action not performed by the POS program exe. Not sure if it would actually pass PCI audit though.

[Piotr_Kowalczyk]

Hi Jruck,

Thanks you for the reply.

Unfortunately I don't think this meets PCI-DSS requirements which I'm referring to. They want us to monitor unauthorised logs and system files changes so it probably needs to be way more complex...

[danlav]

Hi Piotr!

Were you able to meet the requirement 11.5 (or part of this) with Cortex XDR BIOC?

[Piotr_Kowalczyk]

Hi Dan,

Yes, it required a lot of work as I had to design and create BIOC rules myself but once is set, it is working well.

The hardest part was to find what to monitor. I used following: Track changes to system files and registry keys - Microsoft Defender for Cloud | Microsoft Learn + our important folders. 

[danlav]

Hi Piotr, Thank you so much!