DISA_STIG_Splunk_Enterprise_8.x_for_Linux_REST_API_v2r1.audit from DISA Splunk Enterprise 8.x for Linux v2r1 STIG

SPLK-CL-000020 - Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling) - creation, deletion, modification, or disabling.

CAT|III

CCI|CCI-000015

Rule-ID|SV-251658r992038_rule

STIG-ID|SPLK-CL-000020

Vuln-ID|V-251658

SPLK-CL-000080 - Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the server.

CCI|CCI-000048

Rule-ID|SV-251661r960843_rule

STIG-ID|SPLK-CL-000080

Vuln-ID|V-251661

SPLK-CL-000100 - Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

CCI|CCI-000174

CCI|CCI-003821

Rule-ID|SV-251663r992039_rule

STIG-ID|SPLK-CL-000100

Vuln-ID|V-251663

SPLK-CL-000110 - In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.

CAT|II

Rule-ID|SV-251664r960873_rule

STIG-ID|SPLK-CL-000110

Vuln-ID|V-251664

SPLK-CL-000130 - Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.

CCI|CCI-000169

Rule-ID|SV-251666r960879_rule

STIG-ID|SPLK-CL-000130

Vuln-ID|V-251666

SPLK-CL-000140 - Splunk Enterprise must allow only the individuals appointed by the information system security manager (ISSM) to have full admin rights to the system - ISSM to have full admin rights to the system.

CCI|CCI-000171

CCI|CCI-003831

Rule-ID|SV-251667r992040_rule

STIG-ID|SPLK-CL-000140

Vuln-ID|V-251667

SPLK-CL-000150 - Splunk Enterprise must be configured to offload log records onto a different system or media than the system being audited.

CCI|CCI-001851

Rule-ID|SV-251668r961395_rule

STIG-ID|SPLK-CL-000150

Vuln-ID|V-251668

SPLK-CL-000160 - Splunk Enterprise must be configured to send an immediate alert to the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity - at a minimum when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

CCI|CCI-001855

Rule-ID|SV-251669r961398_rule

STIG-ID|SPLK-CL-000160

Vuln-ID|V-251669

SPLK-CL-000170 - Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

CCI|CCI-001858

Rule-ID|SV-251670r961401_rule

STIG-ID|SPLK-CL-000170

Vuln-ID|V-251670

SPLK-CL-000180 - Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

CCI|CCI-001861

Rule-ID|SV-251671r987681_rule

STIG-ID|SPLK-CL-000180

Vuln-ID|V-251671

SPLK-CL-000250 - Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

CCI|CCI-001348

Rule-ID|SV-251673r960948_rule

STIG-ID|SPLK-CL-000250

Vuln-ID|V-251673

SPLK-CL-000260 - Splunk Enterprise must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

CCI|CCI-000366

Rule-ID|SV-251674r961863_rule

STIG-ID|SPLK-CL-000260

Vuln-ID|V-251674

SPLK-CL-000270 - Splunk Enterprise must use TCP for data transmission.

Rule-ID|SV-251675r961863_rule

STIG-ID|SPLK-CL-000270

Vuln-ID|V-251675

SPLK-CL-000280 - Splunk Enterprise must be configured with a report to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Rule-ID|SV-251676r961863_rule

STIG-ID|SPLK-CL-000280

Vuln-ID|V-251676

SPLK-CL-000290 - Analysis, viewing, and indexing functions, services, and applications used as part of Splunk Enterprise must be configured to comply with DoD-trusted path and access requirements.

Rule-ID|SV-251677r961863_rule

STIG-ID|SPLK-CL-000290

Vuln-ID|V-251677

SPLK-CL-000300 - When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

CCI|CCI-000381

Rule-ID|SV-251678r960963_rule

STIG-ID|SPLK-CL-000300

Vuln-ID|V-251678

SPLK-CL-000320 - Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

CAT|I

CCI|CCI-000764

Rule-ID|SV-251679r960969_rule

STIG-ID|SPLK-CL-000320

Vuln-ID|V-251679

SPLK-CL-000330 - Splunk Enterprise must use HTTPS/SSL for access to the user interface.

CCI|CCI-001941

Rule-ID|SV-251680r960993_rule

STIG-ID|SPLK-CL-000330

Vuln-ID|V-251680

SPLK-CL-000390 - Splunk Enterprise must be installed in FIPS mode to implement NIST FIPS-approved cryptography for all cryptographic functions.

CCI|CCI-000197

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-251686r961029_rule

STIG-ID|SPLK-CL-000390

Vuln-ID|V-251686

SPLK-CL-000450 - Splunk Enterprise must only allow the use of DOD-approved certificate authorities for cryptographic functions.

CCI|CCI-002470

CCI|CCI-004909

CCI|CCI-004910

Rule-ID|SV-251690r992050_rule

STIG-ID|SPLK-CL-000450

Vuln-ID|V-251690

SPLK-CL-000460 - Splunk Enterprise must be configured to protect the confidentiality and integrity of transmitted information.

CCI|CCI-002418

Rule-ID|SV-251691r961632_rule

STIG-ID|SPLK-CL-000460

Vuln-ID|V-251691

SPLK-CL-000490 - Splunk Enterprise must accept the DOD CAC or other PKI credential for identity management and personal authentication.

Detections

Analytics

DISA STIG Splunk Enterprise 8.x for Linux v2r1 STIG REST API

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous