Skip to content
ATO Pathways
  Log In

Splunk Enterprise 8.x for Linux Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000168-AU-002510

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000295-AU-000190

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

    &lt;VulnDiscussion&gt;Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of ...
    Rule Medium Severity
    Show

  • Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

    &lt;VulnDiscussion&gt;Automatic session termination after a period of inactivity addresses the potential for a malicious actor to exploit the unatt...
    Rule Medium Severity
    Show

  • SRG-APP-000291-AU-000200

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling).

    &lt;VulnDiscussion&gt;Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of re-establ...
    Rule Low Severity
    Show

  • SRG-APP-000065-AU-000240

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.

    &lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-APP-000345-AU-000400

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must automatically lock the account until the locked account is released by an administrator when three unsuccessful login attempts in 15 minutes are exceeded.

    &lt;VulnDiscussion&gt;By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-APP-000068-AU-000035

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the server.

    &lt;VulnDiscussion&gt;Display of the DOD-approved use notification before granting access to the application ensures privacy and security notificat...
    Rule Low Severity
    Show

  • SRG-APP-000080-AU-000010

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000086-AU-000020

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.

    &lt;VulnDiscussion&gt;If the application is not configured to collate records based on the time when the events occurred, the ability to perform fo...
    Rule Low Severity
    Show

  • SRG-APP-000086-AU-000390

    <GroupDescription></GroupDescription>
    Group
    Show

  • In a distributed environment, Splunk Enterprise indexers must be configured to ingest log records from its forwarders.

    &lt;VulnDiscussion&gt;Log servers (e.g., syslog servers) are often used on network segments to consolidate from the devices and hosts on that netwo...
    Rule Medium Severity
    Show

  • SRG-APP-000095-AU-000050

    <GroupDescription></GroupDescription>
    Group
    Show

  • The System Administrator (SA) and Information System Security Manager (ISSM) must configure the retention of the log records based on the defined security plan.

    &lt;VulnDiscussion&gt;If authorized individuals do not have the ability to modify auditing parameters in response to a changing threat environment,...
    Rule Low Severity
    Show

  • SRG-APP-000089-AU-000400

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to retain the DoD-defined attributes of the log records sent by the devices and hosts.

    &lt;VulnDiscussion&gt;Log records can be generated from various components within the application (e.g., process, module). Certain specific applica...
    Rule Medium Severity
    Show

  • SRG-APP-000090-AU-000070

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must allow only the individuals appointed by the information system security manager (ISSM) to have full admin rights to the system.

    &lt;VulnDiscussion&gt;Without restricting which roles and individuals can select which events are audited, unauthorized personnel may be able to pr...
    Rule Low Severity
    Show

  • SRG-APP-000358-AU-000100

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to offload log records onto a different system or media than the system being audited.

    &lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common ...
    Rule Medium Severity
    Show

  • SRG-APP-000359-AU-000120

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to send an immediate alert to the system administrator (SA) and information system security officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.

    &lt;VulnDiscussion&gt;If security personnel are not notified immediately upon storage volume utilization reaching 75 percent, they are unable to pl...
    Rule Low Severity
    Show

  • SRG-APP-000360-AU-000130

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.

    &lt;VulnDiscussion&gt;It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required....
    Rule Low Severity
    Show

  • SRG-APP-000361-AU-000140

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

    &lt;VulnDiscussion&gt;If the system were to continue processing after audit failure, actions could be taken on the system that could not be tracked...
    Rule Low Severity
    Show

  • SRG-APP-000118-AU-000100

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise installation directories must be secured.

    &lt;VulnDiscussion&gt;If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially ma...
    Rule Medium Severity
    Show

  • SRG-APP-000125-AU-000300

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.

    &lt;VulnDiscussion&gt;Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to a different ...
    Rule Low Severity
    Show

  • SRG-APP-000516-AU-000330

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured to retain the identity of the original source host or device where the event occurred as part of the log record.

    &lt;VulnDiscussion&gt;In this case the information producer is the device based on IP address or some other identifier of the device producing the ...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AU-000340

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must use TCP for data transmission.

    &lt;VulnDiscussion&gt;If the UDP protocol is used for communication, then data packets that do not reach the server are not detected as a data loss...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AU-000350

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must be configured with a report to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.

    &lt;VulnDiscussion&gt;Detecting when multiple systems are showing anomalies can often indicate an attack. Notifying appropriate personnel can initi...
    Rule Medium Severity
    Show

  • SRG-APP-000516-AU-000410

    <GroupDescription></GroupDescription>
    Group
    Show

  • Analysis, viewing, and indexing functions, services, and applications used as part of Splunk Enterprise must be configured to comply with DoD-trusted path and access requirements.

    &lt;VulnDiscussion&gt;Access to Splunk Enterprise for analysis, viewing, indexing functions, services, and applications, such as analysis tools and...
    Rule Medium Severity
    Show

  • SRG-APP-000141-AU-000090

    <GroupDescription></GroupDescription>
    Group
    Show

  • When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

    &lt;VulnDiscussion&gt;Applications are capable of providing a wide variety of functions and services. Some of the functions and services may not be...
    Rule Medium Severity
    Show

  • SRG-APP-000148-AU-002270

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must use organization-level authentication to uniquely identify and authenticate users.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, organizational users must be uniquely identified and authenticat...
    Rule High Severity
    Show

  • SRG-APP-000156-AU-002380

    <GroupDescription></GroupDescription>
    Group
    Show

  • Splunk Enterprise must use HTTPS/SSL for access to the user interface.

    &lt;VulnDiscussion&gt;A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authen...
    Rule Medium Severity
    Show

  • SRG-APP-000166-AU-002490

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules