Using Wazuh for PCI DSS compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that process credit card payments. The standard was created to increase controls around cardholder data to reduce credit card fraud.

Wazuh helps you meet PCI DSS compliance by performing log data analysis, configuration assessment, malware detection, file integrity monitoring, vulnerability detection, active response, and system inventory. The Wazuh dashboard displays information in near real time, allowing you to filter by event field types, including compliance controls. Wazuh also provides PCI DSS dashboards that make relevant events easier to view. To view the PCI DSS-related data on the Wazuh dashboard:

Navigate to Regulatory Compliance from the Wazuh Overview dashboard, then click PCI DSS.
Click the Dashboard tab to get an overview such as the top 10 agents, PCI DSS requirements, and top requirements over time.
Click the Controls tab to view the PCI DSS requirements breakdown.
Click the Findings tab to view the findings related to the PCI DSS requirements within your environment regardless of the log source.

Wazuh has standard policies that include decoders, Key-Value Databases (KVDBs), and rules that detect attacks, system errors, security misconfigurations, and policy violations. By default, these rules map to the associated PCI DSS requirements. In Wazuh 5.0, rules use the Sigma format. You can map a custom rule to one or more PCI DSS requirements. To do this, add the requirement to the pci_dss list under the compliance field of the rule. For example:

compliance:
  pci_dss:
    - "2.2.1"
    - "6.3.3"

The Wazuh for PCI DSS V4.0 Guide (PDF) explains how Wazuh capabilities and modules assist with meeting PCI DSS 4.0 requirements.

The following sections describe Wazuh capabilities and modules and the technical requirements they support: