DISA_STIG_Splunk_Enterprise_7.x_for_Windows_REST_API_v2r3.audit from DISA Splunk Enterprise 7.x for Windows v2r3 STIG

SPLK-CL-000010 - Splunk Enterprise must be installed with FIPS mode enabled, to implement NIST FIPS 140-2 approved ciphers for all cryptographic functions.

CAT|I

CCI|CCI-002450

Rule-ID|SV-221600r508660_rule

STIG-ID|SPLK-CL-000010

STIG-Legacy|SV-111305

STIG-Legacy|V-102349

Vuln-ID|V-221600

SPLK-CL-000020 - Splunk Enterprise must use organization level authentication to uniquely identify and authenticate users.

CCI|CCI-000764

Rule-ID|SV-221601r663926_rule

STIG-ID|SPLK-CL-000020

STIG-Legacy|SV-111307

STIG-Legacy|V-102351

Vuln-ID|V-221601

SPLK-CL-000030 - Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.

Rule-ID|SV-221602r508660_rule

STIG-ID|SPLK-CL-000030

STIG-Legacy|SV-111309

STIG-Legacy|V-102353

Vuln-ID|V-221602

SPLK-CL-000035 - Splunk Enterprise must display the Standard Mandatory DoD Notice and Consent Banner and accept user acknowledgement before granting access to the application.

CAT|III

CCI|CCI-000048

Rule-ID|SV-221931r508660_rule

STIG-ID|SPLK-CL-000035

STIG-Legacy|SV-111311

STIG-Legacy|V-102355

Vuln-ID|V-221931

SPLK-CL-000040 - Splunk Enterprise must only allow the use of DoD-approved certificate authorities for cryptographic functions.

CAT|II

CCI|CCI-002470

Rule-ID|SV-221932r508660_rule

STIG-ID|SPLK-CL-000040

STIG-Legacy|SV-111363

STIG-Legacy|V-102419

Vuln-ID|V-221932

SPLK-CL-000045 - Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DoD CAC or other smart card credential for identity management, personal authentication, and multifactor authentication.

CCI|CCI-001953

Rule-ID|SV-221605r663928_rule

STIG-ID|SPLK-CL-000045

STIG-Legacy|SV-111313

STIG-Legacy|V-102359

Vuln-ID|V-221605

SPLK-CL-000050 - Splunk Enterprise must use TLS 1.2 and SHA-2 or higher cryptographic algorithms.

CCI|CCI-000803

Rule-ID|SV-221933r508660_rule

STIG-ID|SPLK-CL-000050

STIG-Legacy|SV-111387

STIG-Legacy|V-102439

Vuln-ID|V-221933

SPLK-CL-000060 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

CCI|CCI-001941

Rule-ID|SV-221607r508660_rule

STIG-ID|SPLK-CL-000060

STIG-Legacy|SV-111315

STIG-Legacy|V-102363

Vuln-ID|V-221607

SPLK-CL-000070 - Splunk Enterprise must use SSL to protect the confidentiality and integrity of transmitted information.

CCI|CCI-002418

Rule-ID|SV-221608r508660_rule

STIG-ID|SPLK-CL-000070

STIG-Legacy|SV-111317

STIG-Legacy|V-102365

Vuln-ID|V-221608

SPLK-CL-000080 - Splunk Enterprise must use LDAPS for the LDAP connection.

CCI|CCI-000197

Rule-ID|SV-221609r663930_rule

STIG-ID|SPLK-CL-000080

STIG-Legacy|SV-111319

STIG-Legacy|V-102367

Vuln-ID|V-221609

SPLK-CL-000090 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

CCI|CCI-000381

Rule-ID|SV-221934r508660_rule

STIG-ID|SPLK-CL-000090

STIG-Legacy|SV-111321

STIG-Legacy|V-102369

Vuln-ID|V-221934

SPLK-CL-000105 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-221612r508660_rule

STIG-ID|SPLK-CL-000105

STIG-Legacy|SV-111579

STIG-Legacy|V-102629

Vuln-ID|V-221612

SPLK-CL-000160 - Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

CCI|CCI-000166

Rule-ID|SV-221613r508660_rule

STIG-ID|SPLK-CL-000160

STIG-Legacy|SV-111323

STIG-Legacy|V-102373

Vuln-ID|V-221613

SPLK-CL-000170 - Splunk Enterprise must use TCP for data transmission.

CCI|CCI-000366

Rule-ID|SV-221614r508660_rule

STIG-ID|SPLK-CL-000170

STIG-Legacy|SV-111325

STIG-Legacy|V-102375

Vuln-ID|V-221614

SPLK-CL-000180 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

CCI|CCI-002038

Rule-ID|SV-221937r508660_rule

STIG-ID|SPLK-CL-000180

STIG-Legacy|SV-111365

STIG-Legacy|V-102421

Vuln-ID|V-221937

SPLK-CL-000190 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

CCI|CCI-002361

Rule-ID|SV-221938r508660_rule

STIG-ID|SPLK-CL-000190

STIG-Legacy|SV-111367

STIG-Legacy|V-102423

Vuln-ID|V-221938

SPLK-CL-000200 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, disabling).

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

Rule-ID|SV-221939r508660_rule

STIG-ID|SPLK-CL-000200

STIG-Legacy|SV-111369

STIG-Legacy|V-102425

Vuln-ID|V-221939

SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.

Rule-ID|SV-221940r508660_rule

STIG-ID|SPLK-CL-000235

STIG-Legacy|SV-111389

STIG-Legacy|V-102385

Vuln-ID|V-221940

SPLK-CL-000240 - Splunk Enterprise must enforce the limit of 3 consecutive invalid logon attempts by a user during a 15 minute time period.

CCI|CCI-000044

Rule-ID|SV-221941r508660_rule

STIG-ID|SPLK-CL-000240

STIG-Legacy|SV-111331

STIG-Legacy|V-102387

Vuln-ID|V-221941

SPLK-CL-000250 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

CCI|CCI-000174

Rule-ID|SV-221621r508660_rule

STIG-ID|SPLK-CL-000250

STIG-Legacy|SV-111333

STIG-Legacy|V-102389

Vuln-ID|V-221621

SPLK-CL-000260 - The System Administrator (SA) and Information System Security Officer (ISSO) must configure the retention of the log records based on the defined security plan.

CCI|CCI-001914

Rule-ID|SV-246917r768746_rule

STIG-ID|SPLK-CL-000260

STIG-Legacy|SV-111335

STIG-Legacy|V-102391

Vuln-ID|V-246917

SPLK-CL-000270 - Splunk Enterprise must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to be assigned to the Power User role.

CCI|CCI-000171

Rule-ID|SV-221623r538427_rule

STIG-ID|SPLK-CL-000270

STIG-Legacy|SV-111337

STIG-Legacy|V-102393

Vuln-ID|V-221623

SPLK-CL-000280 - Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report.

CCI|CCI-000172

Rule-ID|SV-221942r508660_rule

STIG-ID|SPLK-CL-000280

STIG-Legacy|SV-111339

STIG-Legacy|V-102395

Vuln-ID|V-221942

SPLK-CL-000290 - Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

CCI|CCI-001855

Rule-ID|SV-221625r508660_rule

STIG-ID|SPLK-CL-000290

STIG-Legacy|SV-111341

STIG-Legacy|V-102397

Vuln-ID|V-221625

SPLK-CL-000300 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

CCI|CCI-001858

Rule-ID|SV-221626r508660_rule

STIG-ID|SPLK-CL-000300

STIG-Legacy|SV-111343

STIG-Legacy|V-102399

Vuln-ID|V-221626

SPLK-CL-000310 - Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

CCI|CCI-001861

Rule-ID|SV-221627r508660_rule

STIG-ID|SPLK-CL-000310

STIG-Legacy|SV-111345

STIG-Legacy|V-102401

Vuln-ID|V-221627

SPLK-CL-000320 - Splunk Enterprise must be configured to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Rule-ID|SV-221628r508660_rule

STIG-ID|SPLK-CL-000320

STIG-Legacy|SV-111347

STIG-Legacy|V-102403

Vuln-ID|V-221628

SPLK-CL-000330 - Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one upper-case character be used.

CCI|CCI-000192

Rule-ID|SV-221629r508660_rule

STIG-ID|SPLK-CL-000330

STIG-Legacy|SV-111349

STIG-Legacy|V-102405

Vuln-ID|V-221629

SPLK-CL-000340 - Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one lower-case character be used.

Detections

Analytics

DISA STIG Splunk Enterprise 7.x for Windows v2r3 REST API

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Oct 16, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.