Which tools may be used to meet Requirement 10.6?

Which tools may be used to meet Requirement 10.6?

• A. Manual review only
• B. Log harvesting, parsing, and alerting tools
• C. Web analytics tools
• D. Email-based reporting only

Answer: (B)

Requirement 10.6 focuses on automated tracking and monitoring of access to network resources and cardholder data. Using log harvesting, parsing, and alerting tools—essentially a SIEM setup—provides centralized collection of logs from many systems, normalizes them into a common format, analyzes and correlates events, and raises real-time alerts when something suspicious or policy-violating occurs. This automated monitoring enables timely detection and response across the cardholder data environment, which manual review alone cannot scale to or reliably cover. Web analytics tools are designed for website traffic, not for comprehensive security logging across the environment. Email-based reporting alone is not automated monitoring and lacks proactive alerting and incident response capabilities.

Requirement 10.6 focuses on automated tracking and monitoring of access to network resources and cardholder data. Using log harvesting, parsing, and alerting tools—essentially a SIEM setup—provides centralized collection of logs from many systems, normalizes them into a common format, analyzes and correlates events, and raises real-time alerts when something suspicious or policy-violating occurs. This automated monitoring enables timely detection and response across the cardholder data environment, which manual review alone cannot scale to or reliably cover. Web analytics tools are designed for website traffic, not for comprehensive security logging across the environment. Email-based reporting alone is not automated monitoring and lacks proactive alerting and incident response capabilities.