Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.
An XCCDF Rule
Description
Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual). The records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so.
- ID
- SV-221613r960864_rule
- Version
- SPLK-CL-000160
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
If the server does not store index data, this fix is N/A.
Edit the following file in the installation folder:
$SPLUNK_HOME/etc/system/local/indexes.conf