SPLK-CL-000320 - Splunk Enterprise must be configured to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Information

Detecting when multiple systems are showing anomalies can often indicate an attack. Notifying appropriate personnel can initiate a proper response and mitigation of the attack.

Splunk can aggregate events from multiple devices and create alerts when specific events occur. Detecting similar events on multiple devices simultaneously may indicate an attack. The ability to alert and report on this activity can aid in thwarting an attack.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure Splunk Enterprise, using the reporting and notification tools, to notify the SA and ISSO, at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Item Details

Audit Name: DISA STIG Splunk Enterprise 7.x for Windows v3r2 REST API

Category: CONFIGURATION MANAGEMENT

Plugin: Splunk

Control ID: e397d6a09c1259351dce5d48667211bfab08ed8965f5ee96a27764936195a193

Detections

Analytics

SPLK-CL-000320 - Splunk Enterprise must be configured to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

Information

Solution

See Also

Item Details