Splunk Enterprise 8.x for Linux Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000068-AU-000035
<GroupDescription></GroupDescription>Group -
Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the server.
<VulnDiscussion>Display of the DOD-approved use notification before granting access to the application ensures privacy and security notificat...Rule Low Severity -
SRG-APP-000080-AU-000010
<GroupDescription></GroupDescription>Group -
SRG-APP-000086-AU-000020
<GroupDescription></GroupDescription>Group -
Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.
<VulnDiscussion>If the application is not configured to collate records based on the time when the events occurred, the ability to perform fo...Rule Low Severity -
SRG-APP-000086-AU-000390
<GroupDescription></GroupDescription>Group -
In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.
<VulnDiscussion>Log servers (e.g., syslog servers) are often used on network segments to consolidate from the devices and hosts on that netwo...Rule Medium Severity -
SRG-APP-000095-AU-000050
<GroupDescription></GroupDescription>Group -
The System Administrator (SA) and Information System Security Manager (ISSM) must configure the retention of the log records based on the defined security plan.
<VulnDiscussion>If authorized individuals do not have the ability to modify auditing parameters in response to a changing threat environment,...Rule Low Severity -
SRG-APP-000089-AU-000400
<GroupDescription></GroupDescription>Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.