DISA_STIG_Splunk_Enterprise_7.x_for_Windows_REST_API_v2r4.audit from DISA Splunk Enterprise 7.x for Windows v2r4 STIG

SPLK-CL-000010 - Splunk Enterprise must be installed with FIPS mode enabled, to implement NIST FIPS 140-2 approved ciphers for all cryptographic functions.

800-53|SC-13

CAT|I

CCI|CCI-002450

Rule-ID|SV-221600r879885_rule

STIG-ID|SPLK-CL-000010

STIG-Legacy|SV-111305

STIG-Legacy|V-102349

Vuln-ID|V-221600

SPLK-CL-000020 - Splunk Enterprise must use organization level authentication to uniquely identify and authenticate users.

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-221601r879589_rule

STIG-ID|SPLK-CL-000020

STIG-Legacy|SV-111307

STIG-Legacy|V-102351

Vuln-ID|V-221601

SPLK-CL-000030 - Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.

Rule-ID|SV-221602r879589_rule

STIG-ID|SPLK-CL-000030

STIG-Legacy|SV-111309

STIG-Legacy|V-102353

Vuln-ID|V-221602

SPLK-CL-000035 - Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner and accept user acknowledgement before granting access to the application.

800-53|AC-8a.

CAT|III

CCI|CCI-000048

Rule-ID|SV-221931r918482_rule

STIG-ID|SPLK-CL-000035

STIG-Legacy|SV-111311

STIG-Legacy|V-102355

Vuln-ID|V-221931

SPLK-CL-000040 - Splunk Enterprise must only allow the use of DoD-approved certificate authorities for cryptographic functions.

800-53|SC-23(5)

CAT|II

CCI|CCI-002470

Rule-ID|SV-221932r879798_rule

STIG-ID|SPLK-CL-000040

STIG-Legacy|SV-111363

STIG-Legacy|V-102419

Vuln-ID|V-221932

SPLK-CL-000045 - Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DoD CAC or other smart card credential for identity management, personal authentication, and multifactor authentication.

800-53|IA-2(12)

CCI|CCI-001953

Rule-ID|SV-221605r879764_rule

STIG-ID|SPLK-CL-000045

STIG-Legacy|SV-111313

STIG-Legacy|V-102359

Vuln-ID|V-221605

SPLK-CL-000050 - Splunk Enterprise must use TLS 1.2 and SHA-2 or higher cryptographic algorithms.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-221933r879898_rule

STIG-ID|SPLK-CL-000050

STIG-Legacy|SV-111387

STIG-Legacy|V-102439

Vuln-ID|V-221933

SPLK-CL-000060 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

800-53|IA-2(8)

CCI|CCI-001941

Rule-ID|SV-221607r879597_rule

STIG-ID|SPLK-CL-000060

STIG-Legacy|SV-111315

STIG-Legacy|V-102363

Vuln-ID|V-221607

SPLK-CL-000070 - Splunk Enterprise must use SSL to protect the confidentiality and integrity of transmitted information.

800-53|SC-8

CCI|CCI-002418

Rule-ID|SV-221608r879810_rule

STIG-ID|SPLK-CL-000070

STIG-Legacy|SV-111317

STIG-Legacy|V-102365

Vuln-ID|V-221608

SPLK-CL-000080 - Splunk Enterprise must use LDAPS for the LDAP connection.

800-53|IA-5(1)(c)

CCI|CCI-000197

Rule-ID|SV-221609r879609_rule

STIG-ID|SPLK-CL-000080

STIG-Legacy|SV-111319

STIG-Legacy|V-102367

Vuln-ID|V-221609

SPLK-CL-000090 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-221934r879587_rule

STIG-ID|SPLK-CL-000090

STIG-Legacy|SV-111321

STIG-Legacy|V-102369

Vuln-ID|V-221934

SPLK-CL-000105 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

800-53|AU-9(2)

CCI|CCI-001348

Rule-ID|SV-221612r879582_rule

STIG-ID|SPLK-CL-000105

STIG-Legacy|SV-111579

STIG-Legacy|V-102629

Vuln-ID|V-221612

SPLK-CL-000160 - Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

800-53|AU-10

CCI|CCI-000166

Rule-ID|SV-221613r879554_rule

STIG-ID|SPLK-CL-000160

STIG-Legacy|SV-111323

STIG-Legacy|V-102373

Vuln-ID|V-221613

SPLK-CL-000170 - Splunk Enterprise must use TCP for data transmission.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-221614r879887_rule

STIG-ID|SPLK-CL-000170

STIG-Legacy|SV-111325

STIG-Legacy|V-102375

Vuln-ID|V-221614

SPLK-CL-000180 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

800-53|IA-11

CCI|CCI-002038

Rule-ID|SV-221937r879762_rule

STIG-ID|SPLK-CL-000180

STIG-Legacy|SV-111365

STIG-Legacy|V-102421

Vuln-ID|V-221937

SPLK-CL-000190 - Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-221938r879673_rule

STIG-ID|SPLK-CL-000190

STIG-Legacy|SV-111367

STIG-Legacy|V-102423

Vuln-ID|V-221938

SPLK-CL-000200 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) when account events are received (creation, deletion, modification, disabling).

800-53|AC-2(4)

CCI|CCI-001683

CCI|CCI-001684

CCI|CCI-001685

CCI|CCI-001686

Rule-ID|SV-221939r879669_rule

STIG-ID|SPLK-CL-000200

STIG-Legacy|SV-111369

STIG-Legacy|V-102425

Vuln-ID|V-221939

SPLK-CL-000235 - Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.

Rule-ID|SV-221940r879669_rule

STIG-ID|SPLK-CL-000235

STIG-Legacy|SV-111389

STIG-Legacy|V-102385

Vuln-ID|V-221940

SPLK-CL-000240 - Splunk Enterprise must enforce the limit of 3 consecutive invalid logon attempts by a user during a 15 minute time period.

800-53|AC-7a.

CCI|CCI-000044

Rule-ID|SV-221941r879546_rule

STIG-ID|SPLK-CL-000240

STIG-Legacy|SV-111331

STIG-Legacy|V-102387

Vuln-ID|V-221941

SPLK-CL-000250 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

800-53|AU-12(1)

CCI|CCI-000174

Rule-ID|SV-221621r879557_rule

STIG-ID|SPLK-CL-000250

STIG-Legacy|SV-111333

STIG-Legacy|V-102389

Vuln-ID|V-221621

SPLK-CL-000260 - The System Administrator (SA) and Information System Security Officer (ISSO) must configure the retention of the log records based on the defined security plan.

800-53|AU-12(3)

CCI|CCI-001914

Rule-ID|SV-246917r879563_rule

STIG-ID|SPLK-CL-000260

STIG-Legacy|SV-111335

STIG-Legacy|V-102391

Vuln-ID|V-246917

SPLK-CL-000270 - Splunk Enterprise must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to be assigned to the Power User role.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-221623r879560_rule

STIG-ID|SPLK-CL-000270

STIG-Legacy|SV-111337

STIG-Legacy|V-102393

Vuln-ID|V-221623

SPLK-CL-000280 - Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-221942r879874_rule

STIG-ID|SPLK-CL-000280

STIG-Legacy|SV-111339

STIG-Legacy|V-102395

Vuln-ID|V-221942

SPLK-CL-000290 - Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-221625r879732_rule

STIG-ID|SPLK-CL-000290

STIG-Legacy|SV-111341

STIG-Legacy|V-102397

Vuln-ID|V-221625

SPLK-CL-000300 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

Detections

Analytics

DISA STIG Splunk Enterprise 7.x for Windows v2r4 REST API

Audit Details

File Details

Audit Changelog

No revisions found