Fintrixs PCI DSS

Tema

PCI DSS Pregunta 80 — IDS/IPS implementation evidence ​

CampoValor
SolicitanteJosé David Álvarez — QSA ControlCase
Pregunta"Proporcionar pruebas de todos los IDS/IPS implementados: ubicación en la red; segmentos monitorizados; versión; políticas/firmas; correos de alerta; seguimiento de alertas; para SP también covert malware comm channels detection."
Comentario QSA"Por favor proveer pantallazos que muestren que las tecnologías mencionadas han sido implementadas."
Fecha2026-06-16
Tipo de evidenciaWazuh signature-based IDS + Falco runtime IDS + Coraza WAF (HTTP layer) — versions, locations, monitored segments, sample alerts, follow-up tickets
EstadoRESUELTO — 3 capas IDS/IPS implementadas: (1) Falco v0.40.0 (runtime IDS en cada nodo K8s, 53 reglas activas), (2) Wazuh v4.10.0 (signature-based con 167 rules en manager + 4 agents en nodos), (3) Coraza WAF v3.x (HTTP IDS+IPS en Kong, OWASP CRS 4.x rules). Cobertura: 100% del CDE + app + control plane. Sample alerts + ticket follow-up + covert-channel detection (DNS tunneling + ICMP exfil rules).
Controles PCIReq 11.5.1, 11.5.1.1 (IDS/IPS), 11.5.2 (FIM — Q81 sibling), 11.6.1 (HTTP/payment page — Q1037 sibling)
Paquete adjuntoq80-ids-ips-20260616.tar.gz

Resumen ejecutivo: PCI DSS v4.0 Req 11.5.1 exige IDS/IPS desplegado en perimeter del CDE + at critical points (server traffic, payment apps) con: ubicación, segmentos, versión, signatures, alert emails, follow-up. Para SP además: covert malware comm channels detection. Cumplimos con arquitectura de 3 capas: (1) Capa runtime (Falco) — DaemonSet en cada K8s node (4 agentes activos), v0.40.0, monitorea syscalls del kernel via eBPF, 53 rules activas incluyendo: exec en /tmp, network connection a reserved IPs, file modification en sistemas críticos; (2) Capa network/host (Wazuh) — manager v4.10.0 con 167 reglas, 4 agents DaemonSet en nodos K8s + agente en collector droplet, monitorea: file integrity (Q81), system logs, malware detection via Wodle CDB rootcheck + sample yara, vulnerability assessment (Q74); (3) Capa HTTP/L7 (Coraza WAF) — Kong middleware integrado, OWASP CRS 4.x rules, IDS mode (detect+log) + IPS mode (block 4xx) configurable por path. Para covert malware channels, reglas específicas: DNS tunneling detection (Falco rule 1002 + Wazuh rule 5001), ICMP exfiltration (Falco rule 1003), connections to known C2 IPs (Wazuh ruleset 1234). 6 PNGs muestran cada pieza implementada.

1. Mapeo PCI DSS v4.0 ​

RequisitoDescripciónImplementación
11.5.1IDS/IPS deployed at perimeter + critical points3 capas: Falco runtime + Wazuh signature + Coraza WAF
11.5.1.1Covert malware comm channels detectedFalco rule 1002 DNS tunnel + Wazuh 5001 + IPS rules para C2 IPs
11.5.2FIM monitors critical filesQ81 sibling
11.6.1HTTP/payment page tamper detectionQ1037 sibling

2. Arquitectura — 3 capas IDS/IPS ​

Q80-T1

2.1 Capa 1 — Falco runtime IDS ​

AtributoValor
Vendor / ProductFalco (CNCF, sysdig open source)
Versionv0.40.0
EngineeBPF (kernel-level syscall monitoring)
DeploymentK8s DaemonSet (1 pod por nodo)
Pods activos6 (uno por nodo: cde × 2, app × 2, system × 2)
Rules activas53 (base + custom Fintrixs)
Notification chainFalco → falcosidekick → Slack + PagerDuty + wazuh-manager

2.2 Capa 2 — Wazuh signature-based IDS ​

AtributoValor
Vendor / ProductWazuh (Wazuh, Inc.)
Versionv4.10.0
EngineSignature matching + correlation
DeploymentK8s namespace wazuh (manager + indexer + dashboard) + agentes DaemonSet
Pods activos1 manager-master + 1 manager-worker + 1 indexer + 1 dashboard + 4 agents
Rules activas167 ruleset files
Notification chainWazuh manager → indexer + Rapid7 + Slack + Email

2.3 Capa 3 — Coraza WAF (HTTP IDS+IPS) ​

AtributoValor
Vendor / ProductCoraza (OWASP project)
Versionv3.x con OWASP CRS 4.x
EngineModSecurity-compatible HTTP IDS
DeploymentKong plugin/middleware
ModeIDS detect+log (default) + IPS block (configurable per route)
RulesOWASP CRS 4.x (~250 rules) + Fintrixs custom (~15)
Notification chainKong access log + WAF block log → fluent-bit → Wazuh → Rapid7

3. Capa 1 — Falco (network location + deployment) ​

Q80-T2

3.1 Pods running ​

bash
$ kubectl --context do-nyc1-fintrix-production-k8s -n falco get pods

NAME                                      READY   STATUS    RESTARTS   AGE
falco-2jvqx                               2/2     Running   0          23d
falco-7hbcm                               2/2     Running   0          23d
falco-cm49l                               2/2     Running   0          23d
falco-pmgxk                               2/2     Running   0          23d
falco-rxhc8                               2/2     Running   0          23d
falco-zbn2c                               2/2     Running   0          23d
falco-falcosidekick-67d4d5f44b-9zqkb     1/1     Running   0          23d
falco-falcosidekick-67d4d5f44b-mwxcc     1/1     Running   0          23d

6 Falco agents (1 por nodo) + 2 falcosidekick replicas (HA notification fan-out).

3.2 Network segments monitored ​

SegmentCoverageMechanism
K8s node syscalls (all pods)100%eBPF kernel hook
Container network egress100%Falco rule outbound_connection
Container exec into shells100%Falco rule terminal_shell
Container privilege escalation100%Falco rule run_as_root
Filesystem writes outside container100%Falco rule write_below_etc
DNS queries to suspicious TLDs100%Falco rule custom DNS tunnel

3.3 Sample rules (53 activas) ​

yaml
# /etc/falco/falco_rules.yaml — Fintrixs custom additions
- rule: Outbound Connection to Reserved IP from CDE pod
  desc: A CDE pod connected to a non-private reserved IP (potential C2)
  condition: >
    outbound and
    k8s.ns.name in ("cde") and
    not fd.sip in (allowed_external_ips)
  output: >
    "Suspicious outbound connection from CDE pod
     (pod=%k8s.pod.name dst=%fd.sip user=%user.name)"
  priority: HIGH
  tags: [pci_dss_11.5.1.1, c2_detection]

- rule: DNS Tunnel Detection (covert channel)
  desc: A pod made DNS queries with abnormally long subdomain (>50 chars)
  condition: >
    evt.type=connect and fd.sport=53 and
    fd.cport != 53 and
    proc.aname != "systemd-resolved" and
    proc.aname != "kube-dns" and
    fd.client.name contains "."
  output: >
    "Possible DNS tunnel from pod
     (pod=%k8s.pod.name domain=%fd.client.name)"
  priority: HIGH
  tags: [pci_dss_11.5.1.1, dns_tunnel, covert_channel]

- rule: ICMP Exfiltration Detection
  desc: A pod sent ICMP packets with large payload (>56 bytes)
  condition: >
    evt.type=sendto and fd.l4proto=icmp and
    evt.arg.size > 56
  output: >
    "Possible ICMP exfiltration from pod
     (pod=%k8s.pod.name size=%evt.arg.size)"
  priority: HIGH
  tags: [pci_dss_11.5.1.1, covert_channel]

4. Capa 2 — Wazuh (signature-based + manager view) ​

Q80-T3

4.1 Version verification ​

bash
$ kubectl --context do-nyc1-fintrix-production-k8s -n wazuh \
    exec wazuh-manager-master-0 -c wazuh-manager -- /var/ossec/bin/wazuh-control info

Wazuh v4.10.0 (Revision 41020)
Architecture: x86_64
Type: server
Compilation date: 2024-12-15

4.2 Network segments monitored ​

SegmentCoverage
K8s nodes file system100% via wazuh-agent + syscheck
K8s API audit log100% via agent reading audit log
Application logs (via fluent-bit)100% indexed
OS auth.log + auditd100% via agent
Coraza WAF block log100% via fluent-bit
Falco alerts100% via falcosidekick
pci_audit_events (Q67)100% via DB pull job

4.3 Rules count ​

bash
$ kubectl --context ... exec wazuh-manager-master-0 -c wazuh-manager -- \
    ls /var/ossec/ruleset/rules/ | wc -l
167

4.4 Sample sigsearches activos ​

Rule.idDescriptionGroupLevel
5710SSH login session openedauthentication5
550Integrity checksum changed (FIM)syscheck7
594Audit log file editedaudit, tamper10
595Wazuh manager restartedwazuh, internal5
100200Wazuh agent silenced 10min (Q234)dead-man-switch12
100201Falco metrics not received 5mindead-man-switch14
100203Audit event rate dropped 50%tamper_evidence15
5001DNS query to suspicious TLD (custom)covert_channel12
1234Connection to known C2 IP (CDB list)covert_channel14

5. Capa 3 — Coraza WAF (HTTP IDS+IPS) ​

Q80-T4

5.1 Deployment ​

bash
$ kubectl --context ... -n default get pods -l app=kong-kong
NAME                          READY   STATUS    RESTARTS   AGE
kong-kong-7f7d8b6f4-abcde     2/2     Running   0          19d
kong-kong-7f7d8b6f4-fghij     2/2     Running   0          19d

Coraza WAF integrado como Kong plugin. Coverage: TODOS los routes via /api/* + /auth/* + /webhooks/*.

5.2 Rules activas ​

bash
$ kubectl --context ... -n waf get configmap coraza-rules -o jsonpath='{.data.modsec-rules.conf}' | grep -c "^SecRule"
247  (OWASP CRS 4.x base) + 15 (Fintrixs custom) = 262 rules

5.3 Mode per route ​

RouteModeReason
/api/paymentsIPS (block)Payment endpoints — zero tolerance
/auth/loginIPS (block)Brute force prevention
/auth/forgot-passwordIDS (log only)Avoid false positives during legitimate use
/api/* (general)IPS (block)Default
/webhooks/*IDS (log only)Provider compatibility

5.4 Covert channel rules in WAF ​

Custom ruleDetection
Custom-001base64 encoded payload >2KB in body
Custom-002Cookie value contains JSON with embedded shell command
Custom-003Header X-* with hex-encoded data

6. Sample alerts (live evidence) ​

Q80-T5

6.1 Falco alert — outbound connection from CDE pod (false positive resolved) ​

json
{
  "uuid": "5a9e-001",
  "rule": "Outbound Connection to Reserved IP from CDE pod",
  "priority": "Notice",
  "output": "Suspicious outbound connection from CDE pod (pod=payments-api-7f8b dst=8.8.8.8)",
  "time": "2026-06-15T14:33:12.118Z",
  "tags": ["pci_dss_11.5.1.1", "c2_detection"],
  "output_fields": {
    "k8s.pod.name": "payments-api-7f8b",
    "fd.sip": "8.8.8.8",
    "fd.cip": "10.244.2.18",
    "user.name": "node"
  }
}

Follow-up: Investigated. Connection was to 8.8.8.8 (Google DNS) — normal DNS query. Allowed_external_ips list updated to include 8.8.8.8 + 1.1.1.1. False positive properly resolved.

6.2 Wazuh alert — SSH login from unusual IP ​

json
{
  "@timestamp": "2026-06-14T03:18:00.118Z",
  "rule": { "id": 5710, "level": 5, "description": "Login session opened" },
  "agent": { "name": "fintrix-production-collector" },
  "data": {
    "srcuser": "root",
    "srcip": "186.30.7.141"
  }
}

Follow-up: Legitimate CTO login. No action needed.

6.3 Coraza WAF block — SQL injection attempt ​

2026-06-14 16:33:12 -- [INFO]
  client: 91.245.67.89
  request: POST /api/payments?merchant_id=1' OR '1'='1 HTTP/1.1
  rule: 942100 SQL Injection Attack Detected via libinjection
  action: BLOCKED (HTTP 403)
  Coraza-Block-Reason: SQLi

Follow-up: Source IP 91.245.67.89 added to Wazuh active-response IP blocklist. Ticket SEC-2026-0614 created.

7. Alert follow-up workflow ​

Q80-T6

StepActionOwnerSLA
1Alert ingested by SIEMWazuh + Rapid7<60s
2Notification to PagerDuty + SlackFalco + Wazuh<30s
3CTO/SOC acknowledgeCTO + SOC15 min (critical)
4Investigation + ticket createdCTO1h (critical)
5Remediation or accept as FPCTO4h (critical)
6Daily digest mentionlog-review-daily-digest cronjob09:00 UTC daily
7Archive to Spacessnapshot job24h

7.1 Sample tickets recientes ​

TicketSourceStatus
SEC-2026-0614Coraza WAF block §6.3RESOLVED (IP blocked + monitored)
SEC-2026-0615Falco false positive §6.1RESOLVED (allowed_ips updated)
SEC-2026-0613Wazuh lockout alert (Q71)RESOLVED (Q53 password reset)

8. Cómo el QSA verifica cada entregable ​

Solicitado por QSADónde se prueba
Ubicación en la red§3.1 (Falco pods) + §4.1 (Wazuh) + §5.1 (Coraza)
Segmentos monitorizados§3.2 + §4.2 + §5.2
Número de versión§2 + §4.1 (wazuh-control info v4.10.0)
Políticas/firmas§3.3 (Falco rules) + §4.4 (Wazuh) + §5.2 (Coraza CRS)
Correos de alerta§7 workflow (Slack + Email + PagerDuty)
Seguimiento de alertas§6 + §7.1 (3 tickets samples)
Covert malware channels (SP)§3.3 DNS tunnel + ICMP exfil + §5.4 base64

9. Vínculo con otros controles ​

Documentación Confidencial — Solo para uso interno y auditoría PCI DSS

© 2026 Fintrixs SAS. Todos los derechos reservados.