SPLK-CL-000160 - Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual).

The records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

If the server does not store index data, this fix is N/A.

Edit the following file in the installation folder:

$SPLUNK_HOME/etc/system/local/indexes.conf

Add the following line to each organization-defined index stanza in brackets [ ]:

enableDataIntegrityControl=true

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Splunk_Enterprise_7-x_for_Windows_V2R3_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000166, Rule-ID|SV-221613r508660_rule, STIG-ID|SPLK-CL-000160, STIG-Legacy|SV-111323, STIG-Legacy|V-102373, Vuln-ID|V-221613

Plugin: Splunk

Control ID: 0a56a1743ea471a003edd1c75aa8282a07b97e4b2a0a994b4cfd2ce5396834b7