DISA_STIG_Splunk_Enterprise_8.x_for_Linux_REST_API_v1r4.audit from DISA Splunk Enterprise 8.x for Linux v1r4 STIG

SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling).

CAT|III

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

Rule-ID|SV-251658r879669_rule

STIG-ID|SPLK-CL-000020

Vuln-ID|V-251658

SPLK-CL-000080 - Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the server.

CCI|CCI-000048

Rule-ID|SV-251661r918485_rule

STIG-ID|SPLK-CL-000080

Vuln-ID|V-251661

SPLK-CL-000100 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

CCI|CCI-000174

Rule-ID|SV-251663r879557_rule

STIG-ID|SPLK-CL-000100

Vuln-ID|V-251663

SPLK-CL-000110 - In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.

CAT|II

Rule-ID|SV-251664r879557_rule

STIG-ID|SPLK-CL-000110

Vuln-ID|V-251664

SPLK-CL-000130 - Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.

CCI|CCI-000169

Rule-ID|SV-251666r879559_rule

STIG-ID|SPLK-CL-000130

Vuln-ID|V-251666

SPLK-CL-000140 - Splunk Enterprise must allow only the individuals appointed by the Information System Security Manager (ISSM) to have full admin rights to the system.

CCI|CCI-000171

Rule-ID|SV-251667r879560_rule

STIG-ID|SPLK-CL-000140

Vuln-ID|V-251667

SPLK-CL-000150 - Splunk Enterprise must be configured to offload log records onto a different system or media than the system being audited.

CCI|CCI-001851

Rule-ID|SV-251668r879731_rule

STIG-ID|SPLK-CL-000150

Vuln-ID|V-251668

SPLK-CL-000160 - Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

CCI|CCI-001855

Rule-ID|SV-251669r879732_rule

STIG-ID|SPLK-CL-000160

Vuln-ID|V-251669

SPLK-CL-000170 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

CCI|CCI-001858

Rule-ID|SV-251670r879733_rule

STIG-ID|SPLK-CL-000170

Vuln-ID|V-251670

SPLK-CL-000180 - Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

CCI|CCI-001861

Rule-ID|SV-251671r879734_rule

STIG-ID|SPLK-CL-000180

Vuln-ID|V-251671

SPLK-CL-000250 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-251673r879582_rule

STIG-ID|SPLK-CL-000250

Vuln-ID|V-251673

SPLK-CL-000260 - Splunk Enterprise must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

CCI|CCI-000366

Rule-ID|SV-251674r879887_rule

STIG-ID|SPLK-CL-000260

Vuln-ID|V-251674

SPLK-CL-000270 - Splunk Enterprise must use TCP for data transmission.

Rule-ID|SV-251675r879887_rule

STIG-ID|SPLK-CL-000270

Vuln-ID|V-251675

SPLK-CL-000280 - Splunk Enterprise must be configured with a report to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Rule-ID|SV-251676r879887_rule

STIG-ID|SPLK-CL-000280

Vuln-ID|V-251676

SPLK-CL-000290 - Analysis, viewing, and indexing functions, services, and applications used as part of Splunk Enterprise must be configured to comply with DoD-trusted path and access requirements.

Rule-ID|SV-251677r879887_rule

STIG-ID|SPLK-CL-000290

Vuln-ID|V-251677

SPLK-CL-000300 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

CCI|CCI-000381

Rule-ID|SV-251678r879587_rule

STIG-ID|SPLK-CL-000300

Vuln-ID|V-251678

SPLK-CL-000320 - Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

CAT|I

CCI|CCI-000764

Rule-ID|SV-251679r879589_rule

STIG-ID|SPLK-CL-000320

Vuln-ID|V-251679

SPLK-CL-000330 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

CCI|CCI-001941

Rule-ID|SV-251680r879597_rule

STIG-ID|SPLK-CL-000330

Vuln-ID|V-251680

SPLK-CL-000390 - Splunk Enterprise must be installed in FIPS mode to implement NIST FIPS-approved cryptography for all cryptographic functions.

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-251686r879609_rule

STIG-ID|SPLK-CL-000390

Vuln-ID|V-251686

SPLK-CL-000450 - Splunk Enterprise must only allow the use of DoD-approved certificate authorities for cryptographic functions.

CCI|CCI-002470

Rule-ID|SV-251690r879798_rule

STIG-ID|SPLK-CL-000450

Vuln-ID|V-251690

SPLK-CL-000460 - Splunk Enterprise must be configured to protect the confidentiality and integrity of transmitted information.

CCI|CCI-002418

Rule-ID|SV-251691r879810_rule

STIG-ID|SPLK-CL-000460

Vuln-ID|V-251691

SPLK-CL-000490 - Splunk Enterprise must accept the DoD CAC or other PKI credential for identity management and personal authentication.

CCI|CCI-001953

Rule-ID|SV-251692r879764_rule

STIG-ID|SPLK-CL-000490

Vuln-ID|V-251692

Detections

Analytics

DISA STIG Splunk Enterprise 8.x for Linux v1r4 STIG REST API

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous