DISA_STIG_Splunk_Enterprise_8.x_for_Linux_REST_API_v1r5.audit from DISA Splunk Enterprise 8.x for Linux v1r5 STIG

SPLK-CL-000020 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, or disabling).

800-53|AC-2(4)

CAT|III

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

Rule-ID|SV-251658r879669_rule

STIG-ID|SPLK-CL-000020

Vuln-ID|V-251658

SPLK-CL-000080 - Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the server.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-251661r918485_rule

STIG-ID|SPLK-CL-000080

Vuln-ID|V-251661

SPLK-CL-000100 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

800-53|AU-12(1)

CCI|CCI-000174

Rule-ID|SV-251663r879557_rule

STIG-ID|SPLK-CL-000100

Vuln-ID|V-251663

SPLK-CL-000110 - In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.

CAT|II

Rule-ID|SV-251664r879557_rule

STIG-ID|SPLK-CL-000110

Vuln-ID|V-251664

SPLK-CL-000130 - Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-251666r879559_rule

STIG-ID|SPLK-CL-000130

Vuln-ID|V-251666

SPLK-CL-000140 - Splunk Enterprise must allow only the individuals appointed by the Information System Security Manager (ISSM) to have full admin rights to the system.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-251667r879560_rule

STIG-ID|SPLK-CL-000140

Vuln-ID|V-251667

SPLK-CL-000150 - Splunk Enterprise must be configured to offload log records onto a different system or media than the system being audited.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-251668r879731_rule

STIG-ID|SPLK-CL-000150

Vuln-ID|V-251668

SPLK-CL-000160 - Splunk Enterprise must be configured to send an immediate alert to the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity - at a minimum when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-251669r929143_rule

STIG-ID|SPLK-CL-000160

Vuln-ID|V-251669

SPLK-CL-000170 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-251670r879733_rule

STIG-ID|SPLK-CL-000170

Vuln-ID|V-251670

SPLK-CL-000180 - Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

800-53|AU-5(4)

CCI|CCI-001861

Rule-ID|SV-251671r879734_rule

STIG-ID|SPLK-CL-000180

Vuln-ID|V-251671

SPLK-CL-000250 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

800-53|AU-9(2)

CCI|CCI-001348

Rule-ID|SV-251673r879582_rule

STIG-ID|SPLK-CL-000250

Vuln-ID|V-251673

SPLK-CL-000260 - Splunk Enterprise must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-251674r879887_rule

STIG-ID|SPLK-CL-000260

Vuln-ID|V-251674

SPLK-CL-000270 - Splunk Enterprise must use TCP for data transmission.

Rule-ID|SV-251675r879887_rule

STIG-ID|SPLK-CL-000270

Vuln-ID|V-251675

SPLK-CL-000280 - Splunk Enterprise must be configured with a report to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Rule-ID|SV-251676r879887_rule

STIG-ID|SPLK-CL-000280

Vuln-ID|V-251676

SPLK-CL-000290 - Analysis, viewing, and indexing functions, services, and applications used as part of Splunk Enterprise must be configured to comply with DoD-trusted path and access requirements.

Rule-ID|SV-251677r879887_rule

STIG-ID|SPLK-CL-000290

Vuln-ID|V-251677

SPLK-CL-000300 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-251678r879587_rule

STIG-ID|SPLK-CL-000300

Vuln-ID|V-251678

SPLK-CL-000320 - Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

800-53|IA-2

CAT|I

CCI|CCI-000764

Rule-ID|SV-251679r879589_rule

STIG-ID|SPLK-CL-000320

Vuln-ID|V-251679

SPLK-CL-000330 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-251680r879597_rule

STIG-ID|SPLK-CL-000330

Vuln-ID|V-251680

SPLK-CL-000390 - Splunk Enterprise must be installed in FIPS mode to implement NIST FIPS-approved cryptography for all cryptographic functions.

800-53|IA-5(1)(c)

800-53|IA-7

800-53|SC-13

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-251686r879609_rule

STIG-ID|SPLK-CL-000390

Vuln-ID|V-251686

SPLK-CL-000450 - Splunk Enterprise must only allow the use of DoD-approved certificate authorities for cryptographic functions.

800-53|SC-23(5)

CCI|CCI-002470

Rule-ID|SV-251690r879798_rule

STIG-ID|SPLK-CL-000450

Vuln-ID|V-251690

SPLK-CL-000460 - Splunk Enterprise must be configured to protect the confidentiality and integrity of transmitted information.

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-251691r879810_rule

STIG-ID|SPLK-CL-000460

Vuln-ID|V-251691

SPLK-CL-000490 - Splunk Enterprise must accept the DoD CAC or other PKI credential for identity management and personal authentication.

Detections

Analytics

DISA STIG Splunk Enterprise 8.x for Linux v1r5 STIG REST API

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous