DISA_STIG_Splunk_Enterprise_7.x_for_Windows_REST_API_v3r1.audit from DISA Splunk Enterprise 7.x for Windows v3r1 STIG

SPLK-CL-000010 - Splunk Enterprise must be installed with FIPS mode enabled, to implement NIST FIPS 140-2 approved ciphers for all cryptographic functions.

800-53|SC-13

CAT|I

CCI|CCI-002450

Rule-ID|SV-221600r961857_rule

STIG-ID|SPLK-CL-000010

STIG-Legacy|SV-111305

STIG-Legacy|V-102349

Vuln-ID|V-221600

SPLK-CL-000020 - Splunk Enterprise must use organization level authentication to uniquely identify and authenticate users.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-221601r960969_rule

STIG-ID|SPLK-CL-000020

STIG-Legacy|SV-111307

STIG-Legacy|V-102351

Vuln-ID|V-221601

SPLK-CL-000030 - Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.

Rule-ID|SV-221602r960969_rule

STIG-ID|SPLK-CL-000030

STIG-Legacy|SV-111309

STIG-Legacy|V-102353

Vuln-ID|V-221602

SPLK-CL-000035 - Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner and accept user acknowledgement before granting access to the application.

800-53|AC-8a.

CAT|III

CCI|CCI-000048

Rule-ID|SV-221931r960843_rule

STIG-ID|SPLK-CL-000035

STIG-Legacy|SV-111311

STIG-Legacy|V-102355

Vuln-ID|V-221931

SPLK-CL-000040 - Splunk Enterprise must only allow the use of DOD-approved certificate authorities for cryptographic functions.

800-53|SC-23(5)

CAT|II

CCI|CCI-002470

CCI|CCI-004909

CCI|CCI-004910

Rule-ID|SV-221932r992030_rule

STIG-ID|SPLK-CL-000040

STIG-Legacy|SV-111363

STIG-Legacy|V-102419

Vuln-ID|V-221932

SPLK-CL-000045 - Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DOD common access card (CAC) or other smart card credential for identity management, personal authentication, and multifactor authentication.

800-53|IA-2(12)

CCI|CCI-001953

CCI|CCI-004047

Rule-ID|SV-221605r992017_rule

STIG-ID|SPLK-CL-000045

STIG-Legacy|SV-111313

STIG-Legacy|V-102359

Vuln-ID|V-221605

SPLK-CL-000050 - Splunk Enterprise must use TLS 1.2 and SHA-2 or higher cryptographic algorithms.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-221933r961896_rule

STIG-ID|SPLK-CL-000050

STIG-Legacy|SV-111387

STIG-Legacy|V-102439

Vuln-ID|V-221933

SPLK-CL-000060 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-221607r960993_rule

STIG-ID|SPLK-CL-000060

STIG-Legacy|SV-111315

STIG-Legacy|V-102363

Vuln-ID|V-221607

SPLK-CL-000070 - Splunk Enterprise must use SSL to protect the confidentiality and integrity of transmitted information.

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-221608r961632_rule

STIG-ID|SPLK-CL-000070

STIG-Legacy|SV-111317

STIG-Legacy|V-102365

Vuln-ID|V-221608

SPLK-CL-000080 - Splunk Enterprise must use LDAPS for the LDAP connection.

800-53|IA-5(1)(c)

CCI|CCI-000197

Rule-ID|SV-221609r961029_rule

STIG-ID|SPLK-CL-000080

STIG-Legacy|SV-111319

STIG-Legacy|V-102367

Vuln-ID|V-221609

SPLK-CL-000090 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-221934r960963_rule

STIG-ID|SPLK-CL-000090

STIG-Legacy|SV-111321

STIG-Legacy|V-102369

Vuln-ID|V-221934

SPLK-CL-000105 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

800-53|AU-9(2)

CCI|CCI-001348

Rule-ID|SV-221612r960948_rule

STIG-ID|SPLK-CL-000105

STIG-Legacy|SV-111579

STIG-Legacy|V-102629

Vuln-ID|V-221612

SPLK-CL-000160 - Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

800-53|AU-10

CCI|CCI-000166

Rule-ID|SV-221613r960864_rule

STIG-ID|SPLK-CL-000160

STIG-Legacy|SV-111323

STIG-Legacy|V-102373

Vuln-ID|V-221613

SPLK-CL-000170 - Splunk Enterprise must use TCP for data transmission.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-221614r961863_rule

STIG-ID|SPLK-CL-000170

STIG-Legacy|SV-111325

STIG-Legacy|V-102375

Vuln-ID|V-221614

SPLK-CL-000180 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

800-53|SC-11

CCI|CCI-004895

Rule-ID|SV-221937r992031_rule

STIG-ID|SPLK-CL-000180

STIG-Legacy|SV-111365

STIG-Legacy|V-102421

Vuln-ID|V-221937

SPLK-CL-000190 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-221938r961221_rule

STIG-ID|SPLK-CL-000190

STIG-Legacy|SV-111367

STIG-Legacy|V-102423

Vuln-ID|V-221938

SPLK-CL-000200 - Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, disabling) - creation, deletion, modification, disabling.

800-53|AC-2(1)

CCI|CCI-000015

Rule-ID|SV-221939r992034_rule

STIG-ID|SPLK-CL-000200

STIG-Legacy|SV-111369

STIG-Legacy|V-102425

Vuln-ID|V-221939

SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.

Rule-ID|SV-221940r992035_rule

STIG-ID|SPLK-CL-000235

STIG-Legacy|SV-111389

STIG-Legacy|V-102385

Vuln-ID|V-221940

SPLK-CL-000240 - Splunk Enterprise must enforce the limit of 3 consecutive invalid logon attempts by a user during a 15 minute time period.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-221941r960840_rule

STIG-ID|SPLK-CL-000240

STIG-Legacy|SV-111331

STIG-Legacy|V-102387

Vuln-ID|V-221941

SPLK-CL-000250 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

800-53|AU-12(1)

CCI|CCI-000174

CCI|CCI-003821

Rule-ID|SV-221621r992018_rule

STIG-ID|SPLK-CL-000250

STIG-Legacy|SV-111333

STIG-Legacy|V-102389

Vuln-ID|V-221621

SPLK-CL-000260 - The System Administrator (SA) and Information System Security Officer (ISSO) must configure the retention of the log records based on the defined security plan.

800-53|AU-12(3)

CCI|CCI-001914

Rule-ID|SV-246917r960891_rule

STIG-ID|SPLK-CL-000260

STIG-Legacy|SV-111335

STIG-Legacy|V-102391

Vuln-ID|V-246917

SPLK-CL-000270 - Splunk Enterprise must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to be assigned to the Power User role - or individuals or roles appointed by the ISSM to be assigned to the Power User role.

800-53|AU-12b.

CCI|CCI-000171

CCI|CCI-003831

Rule-ID|SV-221623r992020_rule

STIG-ID|SPLK-CL-000270

STIG-Legacy|SV-111337

STIG-Legacy|V-102393

Vuln-ID|V-221623

SPLK-CL-000280 - Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-221942r961824_rule

STIG-ID|SPLK-CL-000280

STIG-Legacy|SV-111339

STIG-Legacy|V-102395

Vuln-ID|V-221942

SPLK-CL-000290 - Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-221625r961398_rule

STIG-ID|SPLK-CL-000290

STIG-Legacy|SV-111341

STIG-Legacy|V-102397

Vuln-ID|V-221625

SPLK-CL-000300 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-221626r961401_rule

Detections

Analytics

DISA STIG Splunk Enterprise 7.x for Windows v3r1 REST API

Audit Details

File Details

Audit Changelog

No revisions found