SPLK-CL-000030 - Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.

Information

User accounts should use an organizational level authentication mechanism such as SAML, LDAP, AD, etc., to provide centralized management.

The use of local accounts should be discouraged, except for an emergency account of last resort.

The use of local accounts instead of organizational level accounts creates a risk where accounts are not properly disabled or deleted when users depart or their roles change.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Select Settings >> Access Controls >> Users.

Delete any user account with Authentication system set to Splunk, with the exception of one emergency account of last resort. Splunk will prevent the user from deleting an LDAP account.

Item Details

Audit Name: DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API

Category: IDENTIFICATION AND AUTHENTICATION

Plugin: Splunk

Control ID: 20f10b7a3932386d66bdedee6879e2ee5554a1488f899251af9bbc629d268295

Detections

Analytics

SPLK-CL-000030 - Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.

Information

Solution

See Also

Item Details