Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Splunk Enterprise 7.x for Windows Security Technical Implementation Guide
SRG-APP-000148-AU-002270
SRG-APP-000148-AU-002270
An XCCDF Group - A logical subset of the XCCDF Benchmark
Details
Profiles
Prose
SRG-APP-000148-AU-002270
1 Rule
<GroupDescription></GroupDescription>
Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.
High Severity
<VulnDiscussion>User accounts should use an organizational level authentication mechanism such as SAML, LDAP, AD, etc., to provide centralized management. The use of local accounts should be discouraged, except for an emergency account of last resort. The use of local accounts instead of organizational level accounts creates a risk where accounts are not properly disabled or deleted when users depart or their roles change.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>