Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.

No profile (default benchmark)

I - Mission Critical Classified

I - Mission Critical Public

I - Mission Critical Sensitive

II - Mission Support Classified

II - Mission Support Public

II - Mission Support Sensitive

III - Administrative Classified

III - Administrative Public

III - Administrative Sensitive