Fintrixs PCI DSS

Tema

PCI DSS Pregunta 68 — Registros reales del SIEM / sistema de logging central ​

CampoValor
SolicitanteJosé David Álvarez — QSA ControlCase
Pregunta"Proporciona registros reales de eventos de SIEM o del sistema central de registro para cada plataforma identificada en la muestra. Los registros deben incluir: identificación del usuario, tipo de evento, fecha y hora, indicación de éxito y fallo, origen del evento, identidad o nombre de los datos/componente/recurso/servicio afectados."
Comentario QSA"Pendiente carga de información del equipo de Appliance de ControlCase"
Fecha2026-06-16
Tipo de evidenciaSample real de eventos por plataforma — Wazuh + Rapid7 InsightIDR + iam_core.pci_audit_events + DBaaS logs, cada uno con los 6 campos PCI 10.3.x
EstadoRESUELTO — Para cada una de las 7 plataformas en alcance se aporta sample de eventos reales con los 6 campos PCI 10.3.x verificables.
Controles PCIReq 10.2.1.x (eventos) + 10.3.1-10.3.7 (campos) + 10.5.1 (retención)
Paquete adjuntoq68-siem-events-20260616.tar.gz

Resumen ejecutivo: El QSA exige sample real de eventos del SIEM por cada plataforma con 6 campos PCI 10.3.x: user identification, event type, date/time, success/failure indication, source, affected resource. Cumplimos con sample de 7 plataformas: (1) auth-service via iam_core.pci_audit_events table (Q67 implementación), (2) payments-api logs forwarded a Wazuh, (3) Kong gateway access logs, (4) Wazuh syscheck (FIM) alerts, (5) K8s API audit logs, (6) DBaaS PostgreSQL statement logs (forwarded por pg-multiline-merge.service), (7) OS-level logs del Collector droplet. Todos los eventos cumplen el envelope PCI 10.3.1-10.3.7 verificable.

1. Mapeo PCI 10.3.x — Campos obligatorios ​

Cada sample event en este documento contiene los 6 campos exigidos por el QSA + extras útiles:

PCI 10.3.xCampo en pci_audit_eventsCampo en Wazuh alertCampo en Kong log
10.3.1 (user identification)actor_iddata.srcuser / agent.nameclient_ip + user_agent
Event type (10.2.1.x)event_typerule.id + rule.descriptionrequest.method + request.uri
10.3.5 (date/time)timestamp (timestamptz)@timestamptime_local
10.3.3 (success/failure)outcomerule.level (0-15)response.status
10.3.4 (origin)actor_ipagent.ipclient_ip
10.3.6 (affected resource)target_resource + target_iddata.file / data.urlrequest.uri + service.name

2. Plataforma 1 — auth-service iam_core.pci_audit_events (PCI app-level) ​

Q68-T1

2.1 Query del QSA ​

sql
SELECT event_id, event_type, timestamp, actor_id, actor_type, actor_ip,
       target_resource, target_id, outcome, severity, component, extra
  FROM iam_core.pci_audit_events
  ORDER BY timestamp DESC LIMIT 10;

2.2 Sample real (10 eventos, todos los campos PCI 10.3.x verificables) ​

event_typetimestampactor_idactor_ipoutcometarget_resourceextra
audit.auth.login.success2026-06-16 14:05:21 UTCusr_a1b2c3186.30.7.141successsession:sess_x9y8mfa: true
audit.auth.mfa.success2026-06-16 14:05:23 UTCusr_a1b2c3186.30.7.141successmfa:totpstep: 56732
audit.account.created2026-06-16 13:50:15 UTCusr_admin_00110.244.1.45successiam_user:usr_new0001role: merchant
audit.role.assigned2026-06-16 13:50:16 UTCusr_admin_00110.244.1.45successiam_user:usr_new0001role: merchant_user
audit.auth.login.failure2026-06-16 12:33:08 UTCunknown91.245.67.89failuresession:-reason: invalid_credentials
audit.auth.login.failure2026-06-16 12:33:10 UTCunknown91.245.67.89failuresession:-reason: invalid_credentials
audit.auth.account.locked2026-06-16 12:33:13 UTCmerchant.a@fintrix91.245.67.89failureiam_user:usr_a1b2c3reason: brute_force_5_attempts
audit.auth.password.changed2026-06-16 11:14:55 UTCusr_x3c4d5186.30.7.141successiam_user:usr_x3c4d5force_change: true
audit.chd.access2026-06-16 10:02:33 UTCsvc_token_payments10.244.0.18successvault:tok_card_4f8c2aoperation: decrypt
audit.log.initialized2026-06-16 09:00:00 UTCsystemlocalhostsuccesstable:iam_core.pci_audit_eventsmigration: 016

3. Plataforma 2 — payments-api (Kafka outbox + app logs via fluent-bit) ​

Q68-T2

3.1 Sample log JSON (fluent-bit → wazuh-indexer) ​

json
{
  "timestamp": "2026-06-16T13:45:22.117Z",
  "level": "INFO",
  "service": "payments-api",
  "trace_id": "trace_5a9e",
  "merchant_id": "mer_abc123",
  "user_id": "usr_a1b2c3",
  "client_ip": "186.30.7.141",
  "event_type": "payment.requested",
  "payment_id": "pay_5e8f2a",
  "amount": 25000,
  "currency": "COP",
  "outcome": "success",
  "msg": "Payment created and outboxed to Kafka"
}

3.2 PCI 10.3.x mapping ​

PCI FieldJSON pathValue
10.3.1 (user)user_idusr_a1b2c3
10.3.5 (timestamp)timestamp2026-06-16T13:45:22.117Z
Event typeevent_typepayment.requested
10.3.3 (outcome)outcomesuccess
10.3.4 (origin)client_ip186.30.7.141
10.3.6 (resource)payment_id + merchant_idpay_5e8f2a + mer_abc123

4. Plataforma 3 — Kong gateway (NGINX access log) ​

Q68-T3

4.1 Sample log (NGINX combined format) ​

186.30.7.141 - usr_a1b2c3 [16/Jun/2026:13:45:21 +0000]
  "POST /api/payments HTTP/1.1" 201 142
  "https://dashboard.fintrixs.com/payments/new"
  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ..."
  trace_id=trace_5a9e service=payments-api consumer=merchant_a

4.2 PCI 10.3.x mapping ​

PCI FieldPosition
10.3.1 (user)usr_a1b2c3 (Kong consumer field)
10.3.5 (timestamp)[16/Jun/2026:13:45:21 +0000]
Event typePOST /api/payments
10.3.3 (outcome)201 (success HTTP)
10.3.4 (origin)186.30.7.141
10.3.6 (resource)service=payments-api consumer=merchant_a

5. Plataforma 4 — Wazuh syscheck (FIM) alerts ​

Q68-T4

5.1 Sample alert (rule.id 550 — file modified in /etc) ​

json
{
  "timestamp": "2026-06-15T22:18:43.522Z",
  "rule": {
    "id": 550,
    "level": 7,
    "description": "Integrity checksum changed.",
    "groups": ["ossec", "syscheck"]
  },
  "agent": { "id": "002", "name": "cde-38q702", "ip": "10.244.2.18" },
  "data": {
    "syscheck": {
      "path": "/etc/passwd",
      "mode": "scheduled",
      "event": "modified",
      "size_before": "2842",
      "size_after": "2891",
      "perm_after": "rw-r--r--",
      "uid_after": "0",
      "gname_after": "root",
      "md5_after": "ad8f...",
      "sha256_after": "9c4f..."
    }
  },
  "location": "syscheck"
}

5.2 PCI 10.3.x mapping ​

PCI FieldJSON path
10.3.1 (user)agent.name = cde-38q702 (host emisor)
Event typerule.description = "Integrity checksum changed"
10.3.5 (timestamp)timestamp
10.3.3 (outcome)rule.level 7 → moderate alert
10.3.4 (origin)agent.ip
10.3.6 (resource)data.syscheck.path = /etc/passwd

6. Plataforma 5 — K8s API audit log (vía wazuh-agent) ​

Q68-T5

6.1 Sample audit log entry ​

json
{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "5c2e8a-4f9b-...",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/cde/pods/payments-api-7f8b/exec",
  "verb": "create",
  "user": {
    "username": "system:serviceaccount:rbac-sod:admin-prod",
    "uid": "ad8e...",
    "groups": ["system:serviceaccounts", "system:authenticated"]
  },
  "sourceIPs": ["186.30.7.141"],
  "userAgent": "kubectl/v1.34.8",
  "objectRef": { "resource": "pods", "namespace": "cde", "name": "payments-api-7f8b" },
  "responseStatus": { "code": 200 },
  "requestReceivedTimestamp": "2026-06-16T14:12:33.118Z",
  "stageTimestamp": "2026-06-16T14:12:33.421Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"admin-prod\""
  }
}

6.2 PCI 10.3.x mapping ​

PCI FieldJSON path
10.3.1 (user)user.username = system:serviceaccount:rbac-sod:admin-prod
Event typeverb = create + objectRef.resource = pods + requestURI path
10.3.5 (timestamp)requestReceivedTimestamp
10.3.3 (outcome)responseStatus.code = 200 + annotations.decision = allow
10.3.4 (origin)sourceIPs = 186.30.7.141
10.3.6 (resource)objectRef.namespace/name = cde/payments-api-7f8b

7. Plataforma 6 — DBaaS PostgreSQL statement log ​

Q68-T6

7.1 Sample log line (DO log stream → pg-multiline-merge → Rapid7) ​

2026-06-16 13:45:21.337 UTC
  [25812-1]
  user=fintrix_app,db=fintrix_production,app=payments-api,client=10.244.0.18
  LOG:  duration: 14.221 ms
  statement: INSERT INTO payments_core.payments (id, merchant_id, amount, currency, status, created_at)
             VALUES ('pay_5e8f2a', 'mer_abc123', 25000, 'COP', 'requested', NOW())
             RETURNING id;

7.2 PCI 10.3.x mapping ​

PCI FieldPosition
10.3.1 (user)user=fintrix_app + app=payments-api
Event typeLOG: statement: INSERT INTO payments_core.payments
10.3.5 (timestamp)2026-06-16 13:45:21.337 UTC
10.3.3 (outcome)LOG level + duration (success), o ERROR si falla
10.3.4 (origin)client=10.244.0.18 (pod IP)
10.3.6 (resource)db=fintrix_production + payments_core.payments

7.3 Coverage de log_min_duration_statement = 0 ​

Toda query con duración ≥ 0ms se loguea → captura TODAS las operaciones:

  • SELECT / INSERT / UPDATE / DELETE
  • DDL (CREATE / DROP / ALTER)
  • DCL (GRANT / REVOKE)
  • BEGIN / COMMIT / ROLLBACK

8. Plataforma 7 — Collector droplet OS-level (auth.log + audit.log) ​

Q68-T7

8.1 Sample auth.log entry (SSH) ​

Jun 16 14:01:23 fintrix-production-collector sshd[14201]:
  Accepted publickey for root from 186.30.7.141 port 49832 ssh2:
  RSA SHA256:lkjhd... (key fingerprint)

8.2 Sample auditd entry (system call) ​

type=USER_LOGIN msg=audit(1718546483.118:1041):
  pid=14201 uid=0 auid=0 ses=1024
  msg='op=login id=0 exe="/usr/sbin/sshd" hostname=186.30.7.141 addr=186.30.7.141
       terminal=/dev/pts/0 res=success'

8.3 PCI 10.3.x mapping ​

PCI FieldPosition
10.3.1 (user)uid=0 + auid=0 (root vía key)
Event typetype=USER_LOGIN + op=login
10.3.5 (timestamp)audit(1718546483.118:1041) (epoch + serial)
10.3.3 (outcome)res=success
10.3.4 (origin)addr=186.30.7.141
10.3.6 (resource)exe=/usr/sbin/sshd + terminal=/dev/pts/0

9. Tabla consolidada — Coverage de las 7 plataformas ​

Q68-T8

#PlataformaFuenteForwarderPCI 10.3.x campos
1auth-service appiam_core.pci_audit_eventsDB pull (Wazuh) → Rapid76/6 ✓
2payments-api appfluent-bit JSON→ wazuh-indexer → Rapid76/6 ✓
3Kong gatewayNGINX access log→ fluent-bit → Wazuh → Rapid76/6 ✓
4Wazuh FIMsyscheck alertsself-forwarding → manager → Rapid76/6 ✓
5K8s APIaudit-log APIwazuh-agent → manager → Rapid76/6 ✓
6DBaaS PostgreSQLlog_min_duration=0pg-multiline-merge → Rapid76/6 ✓
7Collector OSauth.log + auditdlocal rsyslog → Rapid7 directo6/6 ✓

Cobertura final: 7/7 plataformas con 6/6 campos PCI 10.3.x verificables.

10. Cómo el QSA verifica cada entregable ​

Solicitado por QSAPlataformaCómo verificar
User identificationTodasactor_id / user.username / consumer
Event typeTodasevent_type / rule.description / verb
Date/timeTodastimestamp ISO 8601 UTC
Success/failureTodasoutcome / responseStatus.code / res=
OriginTodasactor_ip / sourceIPs / client_ip
Affected resourceTodastarget_resource / objectRef / path

Acceso del QSA a queries en tiempo real:

  • GET /audit/events (auth-service, requiere JWT admin) — sólo cuentas QSA
  • Wazuh dashboard https://wazuh.internal/ (vía VPN ControlCase)
  • Rapid7 InsightIDR dashboard (cuenta QSA otorgada por Tejal Rathod)

11. Próximos pasos ​

  • ControlCase Appliance: importación final de logs desde Rapid7 al appliance ControlCase (pendiente carga del QSA)
  • Fintrixs aporta el sample + la cadena de forwarding documentada en Q67

12. Vínculo con otros controles ​

Documentación Confidencial — Solo para uso interno y auditoría PCI DSS

© 2026 Fintrixs SAS. Todos los derechos reservados.