<div><div dir="auto">I have used audit logs instead of a FIM solution for PCI compliance at the system/OS level. IMO most FIM-only products do not provide a significant value or reduction in threats.</div></div><div dir="auto"> </div><div dir="auto">Farhan</div><div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jan 13, 2020 at 12:46 PM MAUPERTUIS, PHILIPPE <<a href="mailto:philippe.maupertuis@equensworldline.com">philippe.maupertuis@equensworldline.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div lang="FR" link="blue" vlink="purple"> <div class="m_-493385025883880932WordSection1"> Hi, Redhat is providing audit rules sample for PCI DSS. For the requirement 10.2.7 it is written : ## 10.2.7 Creation and deletion of system-level objects ## This requirement seems to be database table related and not audit However the PCI glossary defines system level objects as : System-level object: Anything on a system component that is required for its operation, including but not limited to database tables, stored procedures, application executables and configuration files, system configuration files, static and shared libraries and DLLs, system executables, device drivers and device configuration files,and third-party components. It seems It should be covered by the FIM solution and not by audit. However loading and unloading kernel modules should probably be covered by auditd. Could you tell me which events are generated in that case ? Are there any others events that should consider for this requirement Regards Philippe </div> equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email </div> -- Linux-audit mailing list <a href="mailto:Linux-audit@redhat.com" target="_blank">Linux-audit@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/linux-audit" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/linux-audit</a></blockquote></div></div>