DISA_STIG_Splunk_Enterprise_8.x_for_Linux_REST_API_v1r3.audit from DISA Splunk Enterprise 8.x for Linux v1r3 STIG

SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling).

CAT|III

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

Rule-ID|SV-251658r808210_rule

STIG-ID|SPLK-CL-000020

Vuln-ID|V-251658

SPLK-CL-000080 - Splunk Enterprise must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the server.

CCI|CCI-000048

Rule-ID|SV-251661r808219_rule

STIG-ID|SPLK-CL-000080

Vuln-ID|V-251661

SPLK-CL-000100 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

CCI|CCI-000174

Rule-ID|SV-251663r808225_rule

STIG-ID|SPLK-CL-000100

Vuln-ID|V-251663

SPLK-CL-000110 - In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.

CAT|II

Rule-ID|SV-251664r808228_rule

STIG-ID|SPLK-CL-000110

Vuln-ID|V-251664

SPLK-CL-000130 - Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.

CCI|CCI-000169

Rule-ID|SV-251666r808234_rule

STIG-ID|SPLK-CL-000130

Vuln-ID|V-251666

SPLK-CL-000140 - Splunk Enterprise must allow only the individuals appointed by the Information System Security Manager (ISSM) to have full admin rights to the system.

CCI|CCI-000171

Rule-ID|SV-251667r808237_rule

STIG-ID|SPLK-CL-000140

Vuln-ID|V-251667

SPLK-CL-000150 - Splunk Enterprise must be configured to offload log records onto a different system or media than the system being audited.

CCI|CCI-001851

Rule-ID|SV-251668r808240_rule

STIG-ID|SPLK-CL-000150

Vuln-ID|V-251668

SPLK-CL-000160 - Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

CCI|CCI-001855

Rule-ID|SV-251669r819094_rule

STIG-ID|SPLK-CL-000160

Vuln-ID|V-251669

SPLK-CL-000170 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

CCI|CCI-001858

Rule-ID|SV-251670r808246_rule

STIG-ID|SPLK-CL-000170

Vuln-ID|V-251670

SPLK-CL-000180 - Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

CCI|CCI-001861

Rule-ID|SV-251671r808249_rule

STIG-ID|SPLK-CL-000180

Vuln-ID|V-251671

SPLK-CL-000250 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-251673r808255_rule

STIG-ID|SPLK-CL-000250

Vuln-ID|V-251673

SPLK-CL-000260 - Splunk Enterprise must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

CCI|CCI-000366

Rule-ID|SV-251674r808258_rule

STIG-ID|SPLK-CL-000260

Vuln-ID|V-251674

SPLK-CL-000270 - Splunk Enterprise must use TCP for data transmission.

Rule-ID|SV-251675r819097_rule

STIG-ID|SPLK-CL-000270

Vuln-ID|V-251675

SPLK-CL-000280 - Splunk Enterprise must be configured with a report to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Rule-ID|SV-251676r808264_rule

STIG-ID|SPLK-CL-000280

Vuln-ID|V-251676

SPLK-CL-000290 - Analysis, viewing, and indexing functions, services, and applications used as part of Splunk Enterprise must be configured to comply with DoD-trusted path and access requirements.

Rule-ID|SV-251677r835285_rule

STIG-ID|SPLK-CL-000290

Vuln-ID|V-251677

SPLK-CL-000300 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

CCI|CCI-000381

Rule-ID|SV-251678r808270_rule

STIG-ID|SPLK-CL-000300

Vuln-ID|V-251678

SPLK-CL-000320 - Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

CAT|I

CCI|CCI-000764

Rule-ID|SV-251679r819103_rule

STIG-ID|SPLK-CL-000320

Vuln-ID|V-251679

SPLK-CL-000330 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

CCI|CCI-001941

Rule-ID|SV-251680r819106_rule

STIG-ID|SPLK-CL-000330

Vuln-ID|V-251680

SPLK-CL-000390 - Splunk Enterprise must be installed in FIPS mode to implement NIST FIPS-approved cryptography for all cryptographic functions.

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-251686r808294_rule

STIG-ID|SPLK-CL-000390

Vuln-ID|V-251686

SPLK-CL-000450 - Splunk Enterprise must only allow the use of DoD-approved certificate authorities for cryptographic functions.

CCI|CCI-002470

Rule-ID|SV-251690r808306_rule

STIG-ID|SPLK-CL-000450

Vuln-ID|V-251690

SPLK-CL-000460 - Splunk Enterprise must be configured to protect the confidentiality and integrity of transmitted information.

CCI|CCI-002418

Rule-ID|SV-251691r819133_rule

STIG-ID|SPLK-CL-000460

Vuln-ID|V-251691

SPLK-CL-000490 - Splunk Enterprise must accept the DoD CAC or other PKI credential for identity management and personal authentication.

CCI|CCI-001953

Rule-ID|SV-251692r808312_rule

STIG-ID|SPLK-CL-000490

Vuln-ID|V-251692

Detections

Analytics

DISA STIG Splunk Enterprise 8.x for Linux v1r3 STIG REST API

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.3 Oct 23, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Mar 10, 2023 Miscellaneous Metadata updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.