{"stig":{"title":"Splunk Enterprise 7.x for Windows Security Technical Implementation Guide","version":"3","release":"2"},"checks":[{"vulnId":"V-221600","ruleId":"SV-221600r961857_rule","severity":"high","ruleTitle":"Splunk Enterprise must be installed with FIPS mode enabled, to implement NIST FIPS 140-2 approved ciphers for all cryptographic functions.","description":"FIPS 140-2 precludes the use of unvalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.","checkContent":"Select the Search and Reporting App.\n\nExecute a search query using the following:\n\n| rest splunk_server=local /services/server/info | fields fips_mode\n\nVerify that the report returns fips_mode = 1.\n\nIf the query returns 0, this is a finding.","fixText":"FIPS 140-2 mode MUST be enabled during installation. If not enabled, it requires a reinstall or upgrade of the application.\n\nThe installer must be executed from the command line so that it can be passed the LAUNCHSPLUNK=0 parameter.\n\nThis allows Splunk to install and not automatically start up after install.\n\nExample: msiexec /i <splunkinstaller.msi> LAUNCHSPLUNK=0\n\nUsing a text editor, edit $SPLUNK_HOME/etc/splunk-launch.conf file, add the line SPLUNK_FIPS=1 to it, restart the server, and then recheck this requirement.","ccis":["CCI-002450"]},{"vulnId":"V-221601","ruleId":"SV-221601r1051115_rule","severity":"high","ruleTitle":"Splunk Enterprise must use organization level authentication to uniquely identify and authenticate users.","description":"To ensure accountability and prevent unauthenticated access, organizational users must be uniquely identified and authenticated to prevent potential misuse and compromise of the system. \n\nSharing of accounts prevents accountability and non-repudiation. Organizational users must be uniquely identified and authenticated for all accesses. The use of an organizational level authentication mechanism provides centralized management of accounts, and provides many benefits not normally leveraged by local account mechanisms.","checkContent":"If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.\n\nSelect Settings >> Access Controls >> Authentication method.\n\nVerify that LDAP or SAML is selected.\n\nIf LDAP or SAML is not selected, this is a finding.","fixText":"Select Settings >> Access Controls >> Authentication method.\n\nIf using LDAP for user accounts:\nSelect LDAP and create an LDAP strategy with the proper settings to connect to the LDAP server.\nMap the appropriate LDAP groups to the appropriate Splunk roles for proper user access.\n\nIf using SAML for user accounts:\nSelect SAML and create an SAML strategy with the proper settings to connect to the SAML provider.\nMap the appropriate SAML groups to the appropriate Splunk roles for proper user access.","ccis":["CCI-000764"]},{"vulnId":"V-221602","ruleId":"SV-221602r1051115_rule","severity":"high","ruleTitle":"Splunk Enterprise must have all local user accounts removed after implementing organizational level user management system, except for one emergency account of last resort.","description":"User accounts should use an organizational level authentication mechanism such as SAML, LDAP, AD, etc., to provide centralized management.\n\nThe use of local accounts should be discouraged, except for an emergency account of last resort.\n\nThe use of local accounts instead of organizational level accounts creates a risk where accounts are not properly disabled or deleted when users depart or their roles change.","checkContent":"Select Settings >> Access Controls >> Users. \n\nVerify that no user accounts exist with Authentication system set to Splunk except an account of last resort. They should all be set to LDAP or SAML.\n\nIf any user accounts have Authentication system set to Splunk, with the exception of one emergency account of last resort, this is a finding.","fixText":"Select Settings >> Access Controls >> Users. \n\nDelete any user account with Authentication system set to Splunk, with the exception of one emergency account of last resort. Splunk will prevent the user from deleting an LDAP account.","ccis":["CCI-000764"]},{"vulnId":"V-221605","ruleId":"SV-221605r992017_rule","severity":"medium","ruleTitle":"Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DOD common access card (CAC) or other smart card credential for identity management, personal authentication, and multifactor authentication.","description":"The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.\n\nDOD has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as a primary component of layered protection for national security systems.\n\nIf the application cannot meet this requirement, the risk may be mitigated through use of an authentication server.","checkContent":"If the instance being checked is in a distributed environment and has the web interface disabled, this check is Not Applicable.\n\nVerify that Splunk Enterprise is configured to use the DOD CAC credential to log into the application.\n\nIf it is not configured to allow the use of the DOD CAC credential, this is a finding.","fixText":"Configure an SSO proxy service using Apache, IIS, F5, SAML, etc., to provide CAC credentials to Splunk Enterprise. \n\nExamples for Apache and F5 are provided using the supplemental documentation included in this package to be used in addition to the Splunk documentation.","ccis":["CCI-001953","CCI-004047"]},{"vulnId":"V-221607","ruleId":"SV-221607r960993_rule","severity":"medium","ruleTitle":"Splunk Enterprise must use HTTPS/SSL for access to the user interface.","description":"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\n\nAnti-replay is a cryptographically based mechanism; thus, it must use FIPS-approved algorithms. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Note that the anti-replay service is implicit when data contains monotonically increasing sequence numbers and data integrity is assured. Use of DoD PKI is inherently compliant with this requirement for user and device access. Use of Transport Layer Security (TLS), including application protocols, such as HTTPS and DNSSEC, that use TLS/SSL as the underlying security protocol is also complaint.\n\nConfigure the information system to use the hash message authentication code (HMAC) algorithm for authentication services to Kerberos, SSH, web management tool, and any other access method.","checkContent":"This check is performed on the machine used as a search head, which may be a separate machine in a distributed environment.\n\nIf the instance being reviewed is not used as a search head, this check in N/A.\n\nSelect Settings >> Server Settings >> General Settings and verify that Enable SSL in Splunk Web is set.\n\nIf Enable SSL is not set, this is a finding.","fixText":"This configuration is performed on the machine used as a search head, which may be a separate machine in a distributed environment.\n\nEdit the following file in the installation to configure Splunk to use SSL certificates:\n\n$SPLUNK_HOME/etc/system/local/web.conf\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\n[settings]\nenableSplunkWebSSL = true\nprivKeyPath = <path to the private key generated for the DoD approved certificate>\nserverCert = <path to the DoD approved certificate in PEM format>","ccis":["CCI-001941"]},{"vulnId":"V-221608","ruleId":"SV-221608r961632_rule","severity":"high","ruleTitle":"Splunk Enterprise must use SSL to protect the confidentiality and integrity of transmitted information.","description":"Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered. \n\nThis requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications must leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec.\n\nCommunication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and this check will be N/A.","checkContent":"Execute a search query in Splunk using the following:\n\nindex=_internal source=*metrics.log* group=tcpin_connections | dedup hostname | table _time hostname sourceIp destPort ssl\n\nVerify that the report returns ssl = true for every item listed.\n\nIf the report returns ssl = false for any item, this is a finding.","fixText":"Edit the following files in the installation to configure Splunk to use SSL certificates:\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\nThis configuration is performed on the machine used as an indexer, which may be a separate machine in a distributed environment.\n\n$SPLUNK_HOME/etc/system/local/inputs.conf\n\n[splunktcp-ssl:9997]\ndisabled = 0\n\n[SSL]\nserverCert = <path to the DoD approved certificate in PEM format>\nsslPassword = <password for the certificate>\n\nThis configuration is performed on the machine used as a forwarder, which is always a separate machine regardless of environment.\n\n$SPLUNK_HOME/etc/system/local/outputs.conf\n\n[tcpout:group1]\ndisabled = 0\nclientCert = <path to the DoD approved certificate in PEM format>\nsslPassword = <password for the certificate>","ccis":["CCI-002418"]},{"vulnId":"V-221609","ruleId":"SV-221609r961029_rule","severity":"high","ruleTitle":"Splunk Enterprise must use LDAPS for the LDAP connection.","description":"Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.\n\nSecuring the connection to the LDAP servers mitigates this risk.","checkContent":"If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.\n\nIf using SAML for authentication, this check is N/A.\n\nSelect Settings >> Access Controls >> Authentication method.\n\nSelect LDAP Settings.\n\nSelect the LDAP strategy and verify that SSL enabled is checked and the Port is set to 636.\n\nIf SSL enabled is not checked, and Port is not 636, this is a finding.","fixText":"If using SAML for authentication, this fix is N/A.\n\nSelect Settings >> Access Controls >> Authentication method.\n\nSelect LDAP Settings.\n\nSelect the LDAP strategy and check the option SSL enabled.\n\nSet Port to 636.\n\nEdit the following file in the installation to configure Splunk to use SSL certificates:\n\n$SPLUNK_HOME/etc/openldap/ldap.conf\n\nAdd the following line:\n\nTLS_CACERT <path to the DoD approved certificate in PEM format>","ccis":["CCI-000197"]},{"vulnId":"V-221612","ruleId":"SV-221612r960948_rule","severity":"low","ruleTitle":"Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.","description":"Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to ensure that in the event of a catastrophic system failure, the log records will be retained. \n\nThis helps to ensure that a compromise of the information system being audited does not also result in a compromise of the log records.\n\nThis requirement only applies to applications that have a native backup capability for log records. Operating system backup requirements cover applications that do not provide native backup functions.","checkContent":"Interview the SA to verify that a process exists to back up the Splunk log data every seven days, using the underlying OS backup tools, or another approved backup tool.\n\nIf a backup plan does not exist for the Splunk log data, this is a finding.","fixText":"Implement a backup plan for the Splunk log data, following the Splunk documentation on backing up indexed data. Use the underlying OS backup tools, or another approved backup tool.","ccis":["CCI-001348"]},{"vulnId":"V-221613","ruleId":"SV-221613r960864_rule","severity":"medium","ruleTitle":"Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.","description":"Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual).\n\nThe records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so.","checkContent":"If the server being reviewed does not store index data, this check is N/A.\n\nCheck the following file in the installation folder:\n\n$SPLUNK_HOME/etc/system/local/indexes.conf\n\nVerify that each organization-defined index stanza in brackets [ ] has the following line added:\n\nenableDataIntegrityControl=true\n\nIf this line is missing or is set to false, this is a finding.","fixText":"If the server does not store index data, this fix is N/A.\n\nEdit the following file in the installation folder:\n\n$SPLUNK_HOME/etc/system/local/indexes.conf\n\nAdd the following line to each organization-defined index stanza in brackets [ ]:\n\nenableDataIntegrityControl=true","ccis":["CCI-000166"]},{"vulnId":"V-221614","ruleId":"SV-221614r961863_rule","severity":"medium","ruleTitle":"Splunk Enterprise must use TCP for data transmission.","description":"If the UDP protocol is used for communication, then data packets that do not reach the server are not detected as a data loss. The use of TCP to transport data improves delivery reliability, adds data integrity, and gives the option to encrypt the traffic.","checkContent":"Select Settings >> Data Inputs, and verify there are zero inputs configured under UDP. Splunk supports UDP, but it is not permissible to use. \n\nIf any exist, this is a finding.\n\nIf the Web UI is disabled, open an OS command prompt and type:\n\nnetstat -a -p UDP\n\nIf a UDP connection is displayed for 0.0.0.0:514, the instance is listening for Syslog port 514 in UDP, and this is a finding.","fixText":"Select Settings >> Data Inputs, and verify there are zero inputs configured under UDP. Remove any that exist and recreate using TCP.\n\nIt is recommended to set these settings before disabling the web UI of the instance in a distributed environment.","ccis":["CCI-000366"]},{"vulnId":"V-221621","ruleId":"SV-221621r992018_rule","severity":"low","ruleTitle":"Splunk Enterprise must be configured to aggregate log records from organization-defined devices and hosts within its scope of coverage.","description":"If the application is not configured to collate records based on the time when the events occurred, the ability to perform forensic analysis and investigations across multiple components is significantly degraded. Centralized log aggregation must also include logs from databases and servers (e.g., Windows) that do not natively send logs using the syslog protocol.","checkContent":"Examine the site documentation that lists the scope of coverage for the instance being reviewed.\n\nSelect Settings >> Data Inputs. Verify that data inputs are configured to support the scope of coverage documented for the site.\n\nIf Splunk enterprise is not configured to aggregate log records from organization-defined devices and hosts within its scope of coverage, this is a finding.","fixText":"Configure Splunk Enterprise to aggregate log records from organization-defined devices and hosts within its scope of coverage, as defined in the site security plan.","ccis":["CCI-000174","CCI-003821"]},{"vulnId":"V-221623","ruleId":"SV-221623r992020_rule","severity":"low","ruleTitle":"Splunk Enterprise must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to be assigned to the Power User role.","description":"Without restricting which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.","checkContent":"If using LDAP:\nSelect Settings >> Access Controls >> Authentication Method >> LDAP Settings >> Map Groups.\nObtain the group name mapped to the power user role.\nRequest from the LDAP administrator the group membership of this LDAP group, and compare to the list of individuals appointed by the ISSM.\n\nIf using SAML:\nSelect Settings >> Access Controls >> Authentication Method >> SAML Settings >> Map Groups.\nObtain the group name mapped to the power user role.\nRequest from the SAML administrator the group membership of this SAML group, and compare to the list of individuals appointed by the ISSM.\n\nIf users that are not defined by the ISSM as requiring elevated rights are present in the power user role membership, this is a finding.","fixText":"Provide the list of individuals assigned by the ISSM to be members of the power user role to the LDAP/AD administrator or SAML Identity Provider administrator to add to the security group mapped to the power user role.","ccis":["CCI-000171","CCI-003831"]},{"vulnId":"V-221625","ruleId":"SV-221625r961398_rule","severity":"low","ruleTitle":"Splunk Enterprise must be configured to send an immediate alert to the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated log record storage volume reaches 75 percent of the repository maximum log record storage capacity.","description":"If security personnel are not notified immediately upon storage volume utilization reaching 75 percent they are unable to plan for storage capacity expansion. \n\nAlthough this may be part of the operating system function, for the enterprise events management system, this is most often a function managed through the application since it is a critical function and requires the use of a large amount of external storage.","checkContent":"Perform the following checks. If any do not comply, this is a finding.\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\n1. Examine the file in the Splunk installation folder:\n\n$SPLUNK_HOME/etc/system/local/server.conf\n\nLocate the following setting:\n\n[diskUsage]\nminFreeSpace =  xxxx\n\nVerify that the value is set to 25 percent of the size of the storage volume. For example, 25 percent of a 100 GB drive is 25 GB, and the value set would be 25000, as the value is in megabytes.\n\n2. Examine the file in the Splunk installation folder:\n\n$SPLUNK_HOME/etc/system/local/health.conf\n\nLocate the following setting:\n\n[alert_action:email]\ndisabled = 0\naction.to =\naction.cc =\n\nVerify that the email addresses of the ISSO and SA are set to receive alerts. This email address can be a group address (example alerts@domain.com) that contains the addresses of the ISSO and SA.\n\n3. In the Splunk console, select Settings >> Health Report Manager >> feature:disk_space.\n\nVerify Red setting is 1, and Yellow setting is 2.","fixText":"Perform the following fixes.\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\n1. Edit the file in the Splunk installation folder:\n\n$SPLUNK_HOME/etc/system/local/server.conf\n\nAdd the following lines:\n\n[diskUsage]\nminFreeSpace =  xxxx\n\nSet the value to 25 percent of the size of the storage volume. For example, 25 percent of a 100 GB drive is 25 GB, and the value set would be 25000, as the value is in megabytes.\n\n2. Examine the file in the Splunk installation folder:\n\n$SPLUNK_HOME/etc/system/local/health.conf\n\nAdd the following lines:\n\n[alert_action:email]\ndisabled = 0\naction.to =\naction.cc =\n\nSet the email addresses of the ISSO and SA to be able to receive alerts. This email address can be a group address (example alerts@domain.com) that contains the addresses of the ISSO and SA.\n\n3. In the Splunk console, select Settings >> Health Report Manager >> feature:disk_space.\n\nSet the Red setting to 1, and Yellow setting to 2.","ccis":["CCI-001855"]},{"vulnId":"V-221626","ruleId":"SV-221626r961401_rule","severity":"low","ruleTitle":"Splunk Enterprise must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) of all audit failure events, such as loss of communications with hosts and devices, or if log records are no longer being received.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit function and application operation may be adversely affected.","checkContent":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is N/A.\n\nInterview the SA to verify that a process exists to notify the SA and ISSO of any audit failure, such as loss of communication or logs no longer being collected.\n\nInterview the ISSO to confirm receipt of this notification.\n\nIf a report does not exist to notify the SA and ISSO of audit failure events, or the ISSO does not confirm receipt of the report, this is a finding.","fixText":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this fix is N/A.\n\nConfigure Splunk Enterprise using the reporting and notification tools to create a report with notification to the SA and ISSO of any audit failure events, such as loss of communication or logs no longer being collected.","ccis":["CCI-001858"]},{"vulnId":"V-221627","ruleId":"SV-221627r1001259_rule","severity":"low","ruleTitle":"Splunk Enterprise must notify the System Administrator (SA) or Information System Security Officer (ISSO) if communication with the host and devices within its scope of coverage is lost.","description":"If the system were to continue processing after audit failure, actions could be taken on the system that could not be tracked and recorded for later forensic analysis. To perform this function, some type of heartbeat configuration with all of the devices and hosts must be configured.","checkContent":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is N/A.\n\nInterview the SA to verify that a process exists to notify the SA and ISSO of any audit failure, such as loss of communication or logs no longer being collected.\n\nInterview the ISSO to confirm receipt of this notification.\n\nIf a report does not exist to notify the SA and ISSO of audit failure events, or the ISSO does not confirm receipt of the report, this is a finding.","fixText":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this fix is N/A.\n\nConfigure Splunk Enterprise using the reporting and notification tools to create a report with notification to the SA and ISSO of any audit failure events, such as loss of communication or logs no longer being collected.","ccis":["CCI-001861"]},{"vulnId":"V-221628","ruleId":"SV-221628r961863_rule","severity":"medium","ruleTitle":"Splunk Enterprise must be configured to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.","description":"Detecting when multiple systems are showing anomalies can often indicate an attack. Notifying appropriate personnel can initiate a proper response and mitigation of the attack.\n\nSplunk can aggregate events from multiple devices and create alerts when specific events occur. Detecting similar events on multiple devices simultaneously may indicate an attack. The ability to alert and report on this activity can aid in thwarting an attack.","checkContent":"Interview the SA to verify that a process exists to notify the SA and ISSO, at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.\n\nInterview the ISSO to confirm receipt of this notification.\n\nIf a report does not exist, or the ISSO does not confirm receipt of this report, this is a finding.","fixText":"Configure Splunk Enterprise, using the reporting and notification tools, to notify the SA and ISSO, at a minimum, when an attack is detected on multiple devices and hosts within its scope of coverage.","ccis":["CCI-000366"]},{"vulnId":"V-221629","ruleId":"SV-221629r1015820_rule","severity":"low","ruleTitle":"Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one uppercase character be used.","description":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Uppercase is set to greater than 0.\n\nIf Uppercase is set to 0, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set Uppercase to greater than 0.","ccis":["CCI-004066","CCI-000192"]},{"vulnId":"V-221630","ruleId":"SV-221630r1015821_rule","severity":"low","ruleTitle":"Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one lowercase character be used.","description":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Lowercase is set to greater than 0.\n\nIf Lowercase is set to 0, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set Lowercase to greater than 0.","ccis":["CCI-004066","CCI-000193"]},{"vulnId":"V-221631","ruleId":"SV-221631r1015822_rule","severity":"low","ruleTitle":"Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one numeric character be used.","description":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Numeral is set to greater than 0.\n\nIf Numeral is set to 0, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set Numeral to greater than 0.","ccis":["CCI-004066","CCI-000194"]},{"vulnId":"V-221632","ruleId":"SV-221632r1015823_rule","severity":"medium","ruleTitle":"Splunk Enterprise must enforce a minimum 15-character password length for the account of last resort.","description":"The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\n\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. \n\nUse of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Minimum characters is set to 15 or more.\n\nIf Minimum characters is less than 15, this is a finding.","fixText":"Select Settings >> Access Controls >>Password Policy Management and set Minimum characters to 15 or more.","ccis":["CCI-004066","CCI-000205"]},{"vulnId":"V-221633","ruleId":"SV-221633r1015824_rule","severity":"low","ruleTitle":"Splunk Enterprise must enforce password complexity for the account of last resort by requiring that at least one special character be used.","description":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor in determining how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nSpecial characters are those characters that are not alphanumeric. Examples include: ~ ! @ # $ % ^ *.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Special character is set to greater than 0.\n\nIf Special character is set to 0, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set Special character to greater than 0.","ccis":["CCI-004066","CCI-001619"]},{"vulnId":"V-221634","ruleId":"SV-221634r1043190_rule","severity":"low","ruleTitle":"Splunk Enterprise must enforce a 60-day maximum password lifetime restriction for the account of last resort.","description":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised.\n\nThis requirement does not include emergency administration accounts that are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that Expiration is Enabled and Days until password expires is set to 60.\n\nIf not set this way, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set Expiration to Enabled and Days until password expires to 60.","ccis":["CCI-004066","CCI-000199"]},{"vulnId":"V-221635","ruleId":"SV-221635r1015267_rule","severity":"low","ruleTitle":"Splunk Enterprise must prohibit password reuse for a minimum of five generations for the account of last resort.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nTo meet password policy requirements, passwords need to be changed at specific policy-based intervals.\n\nIf the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management and verify that History is Enabled and Password history count is set to 5 or more.\n\nIf not set to 5 or more, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management and set History to Enabled and Password history count to 5 or more.","ccis":["CCI-004061"]},{"vulnId":"V-221931","ruleId":"SV-221931r960843_rule","severity":"low","ruleTitle":"Splunk Enterprise must display the Standard Mandatory DOD Notice and Consent Banner and accept user acknowledgement before granting access to the application.","description":"Display of the DOD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with DOD DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n \nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreem't.\"\n\nThe user must acknowledge the notice before being granted access to the application.","checkContent":"This check is performed on the machine used as a search head, which may be a separate machine in a distributed environment.\n\nIf the instance being reviewed is not used as a search head, this check in NA.\n\nVerify that the Standard Mandatory DOD Notice and Consent Banner appears before being granted access to Splunk Enterprise.\n\nIf the Standard Mandatory DOD Notice and Consent Banner is not presented, this is a finding.","fixText":"This configuration is performed on the machine used as a search head, which may be a separate machine in a distributed environment.\n\nConfigure Splunk Enterprise to display the Mandatory DOD Notice and Consent Banner by modifying the web.conf file. \n\nAdd/modify the line: \nlogin_content = <script>function DoDBanner() {alert(\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\\n-At any time, the USG may inspect and seize data stored on this IS.\\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\");}DoDBanner();</script>\n\nThe string in the above line will be the text of the DOD consent banner.","ccis":["CCI-000048"]},{"vulnId":"V-221932","ruleId":"SV-221932r992030_rule","severity":"medium","ruleTitle":"Splunk Enterprise must only allow the use of DOD-approved certificate authorities for cryptographic functions.","description":"Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DOD-approved CA, trust of this CA has not been established.\n\nThe DOD will only accept PKI certificates obtained from a DOD-approved internal or external certificate authority. \n\nSplunk Enterprise contains built-in certificates that are common across all Splunk installations and are for initial deployment. These should not be used in any production environment.\n\nThe production certificates should be stored in another location away from the Splunk default certificates, as that folder is replaced on any upgrade of the application.\n\nAn example would be to use a folder named $SPLUNK_HOME/etc/system/DODcerts under the Splunk installation root folder.","checkContent":"Verify the properties of the certificates used by Splunk to ensure that the Issuer is the DOD trusted CA.\n\nCheck the following files for the certificates in use by Splunk.\n\nThis file is located on the machine used as the search head, which may be a separate machine in a distributed environment.\n\n$SPLUNK_HOME/etc/system/local/web.conf\n\n[settings]\nserverCert = <path to the DOD approved certificate in PEM format>\n\nThis file is located on the machine used as an indexer, which may be a separate machine in a distributed environment.\n\n$SPLUNK_HOME/etc/system/local/inputs.conf\n\n[SSL]\nserverCert = <path to the DOD approved certificate in PEM format>\n\nThis file is located on the machine used as a forwarder, which is always a separate machine regardless of environment.\n\n$SPLUNK_HOME/etc/system/local/outputs.conf\n\n[tcpout:group1]\nclientCert = <path to the DOD approved certificate in PEM format>\n\nVerify each certificate listed above with the following command:\n\nopenssl x509 -text -inform PEM -in <name of cert>\n\nIf the certificate issuer is not a DOD trusted CA, this is a finding.","fixText":"Request a DOD-approved certificate and a copy of the DOD root CA public certificate and place the files in a location for Splunk use.\n\nConfigure the certificate files to the PEM format using the Splunk Enterprise system documentation.","ccis":["CCI-002470","CCI-004909","CCI-004910"]},{"vulnId":"V-221933","ruleId":"SV-221933r961896_rule","severity":"high","ruleTitle":"Splunk Enterprise must use TLS 1.2 and SHA-2 or higher cryptographic algorithms.","description":"Without cryptographic integrity protections, information can be altered by unauthorized users without detection.\n\nTo protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512.\n\nSplunk Enterprise, by default, is compliant with this requirement. But since the settings can be overridden, the check and fix text in this requirement is necessary.","checkContent":"In the Splunk installation folder, check the following files in the $SPLUNK_HOME/etc/system/local folder:\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\ninputs.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\noutputs.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nserver.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below:\n\n sslVersions = tls1.2\n sslVersionsForClient = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nweb.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nCheck the following file in the $SPLUNK_HOME/etc/openldap folder:\n\nldap.conf\n\nCheck for the following lines; they must match the settings below:\n\n #TLS_PROTOCOL_MIN: 3.1 for TLSv1.0, 3.2 for TLSv1.1, 3.3 for TLSv1.2.\n TLS_PROTOCOL_MIN 3.3\n TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n\nIf any of the above settings do not match, this is a finding.","fixText":"In the Splunk installation folder, check the following files in the $SPLUNK_HOME/etc/system/local folder:\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\ninputs.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below or be removed:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\noutputs.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below or be removed:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nserver.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below or be removed:\n\n sslVersions = tls1.2\n sslVersionsForClient = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nweb.conf\n\nCheck for the following lines; if they do not exist, the settings are compliant. If they exist, they must match the settings below or be removed:\n\n sslVersions = tls1.2\n cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256\n ecdhCurves = prime256v1, secp384r1, secp521r1\n\nCheck the following file in the $SPLUNK_HOME/etc/openldap folder:\n\nldap.conf\n\nCheck for the following lines; they must match the settings below:\n\n #TLS_PROTOCOL_MIN: 3.1 for TLSv1.0, 3.2 for TLSv1.1, 3.3 for TLSv1.2.\n TLS_PROTOCOL_MIN 3.3\n TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-\n SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-\n AES128-SHA256:ECDHE-RSA-AES128-SHA256","ccis":["CCI-000803"]},{"vulnId":"V-221934","ruleId":"SV-221934r960963_rule","severity":"medium","ruleTitle":"When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.","description":"Applications are capable of providing a wide variety of functions and services. Some of the functions and services may not be necessary to support the configuration. This becomes more of an issue in distributed environments, where the application functions are spread out over multiple servers.\n\nThese unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.","checkContent":"If the Splunk Installation is not distributed among multiple servers, this check is N/A.\n\nIf the machine being reviewed is not designated as a search head, check the following file in the Splunk installation folders:\n\n$SPLUNK_HOME/etc/system/local/web.conf\n\nCheck for the following lines:\n\n[settings]\nstartwebserver = 0\n\nIf the startwebserver = 0 line is missing, or is = 1, this is a finding.\n\nIf the machine being reviewed is not designated as an indexer, check the following file in the Splunk installation folders:\n\n$SPLUNK_HOME/etc/system/local/indexes.conf\n\nIf this file exists, this is a finding. \n\nThis file should only exist on an instance designated as an indexer.","fixText":"If the Splunk Installation is not distributed among multiple servers, this fix is N/A.\n\nSelect Settings >> Monitoring Console.\n\nIn the Monitoring Console, select Settings >> General Setup.\n\nSet the Mode type based on the implementation design.\n\nIf Mode is set to Distributed, set each instance only with the server roles necessary for the desired functions.\n\nOn instances not designated as search heads, disable the web UI by using the following command:\n\n./splunk disable webserver\n\nOn instances not designated as indexers, remove the file:\n\n$SPLUNK_HOME/etc/system/local/indexes.conf","ccis":["CCI-000381"]},{"vulnId":"V-221935","ruleId":"SV-221935r960930_rule","severity":"medium","ruleTitle":"Splunk Enterprise installation directories must be secured.","description":"If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult if not impossible to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage.\n\nTo ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, and copy access.\n\nThis requirement can be achieved through multiple methods, which will depend on system architecture and design. Commonly employed methods for protecting audit information include least privilege permissions as well as restricting the location and number of log file repositories.\n\nAdditionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring audit information is protected from unauthorized access.\n\nAudit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nSatisfies: SRG-APP-000118-AU-000100, SRG-APP-000119-AU-000110, SRG-APP-000120-AU-000120, SRG-APP-000121-AU-000130, SRG-APP-000122-AU-000140, SRG-APP-000123-AU-000150","checkContent":"This check must be done as a server administrator.\n\nFrom an Explorer window, right-click on the Splunk target installation folder and select Properties.\n\nSelect the Security tab and then the Advanced button.\n\nVerify that Administrators and SYSTEM are the only accounts listed and are set to Full Control.\n\nIf accounts other than Administrators and SYSTEM are listed, this is a finding.","fixText":"This fix must be done as a server administrator.\n\nFrom an Explorer window, right-click on the Splunk target installation folder and select Properties.\n\nSelect the Security tab >> Advanced >> Disable inheritance >> Convert inherited permissions into explicit permissions on this object.\n\nRemove all permission entries except Administrators and SYSTEM, and select OK.","ccis":["CCI-000162","CCI-000163","CCI-000164","CCI-001493","CCI-001494","CCI-001495"]},{"vulnId":"V-221936","ruleId":"SV-221936r961863_rule","severity":"low","ruleTitle":"Splunk Enterprise forwarders must be configured with Indexer Acknowledgement enabled.","description":"To prevent the loss of data during transmission, a handshake acknowledgement between the sender and the recipient may need configured.","checkContent":"If the server being reviewed is not a forwarder, this check is N/A.\n\nIn the Splunk installation folder, check the following file in the $SPLUNK_HOME/etc/system/local folder:\n\noutputs.conf\n\nLocate the section similar to: \n\n[tcpout:group1]\nuseACK=true\n\nNote that group1 may be named differently depending on how tcpout was configured.\n\nIf the useACK=true statement is missing or set to false, this is a finding.","fixText":"If the server is not a forwarder, this check is N/A.\n\nIn the Splunk installation folder, edit the following file in the $SPLUNK_HOME/etc/system/local folder:\n\noutputs.conf\n\nLocate the section similar to: \n\n[tcpout:group1]\n\nNote that group1 may be named differently depending on how tcpout was configured.\n\nAdd the following line under the group stanza above:\n\nuseACK=true","ccis":["CCI-000366"]},{"vulnId":"V-221937","ruleId":"SV-221937r1050786_rule","severity":"low","ruleTitle":"Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.","description":"Without reauthentication, users may access resources or perform tasks for which they do not have authorization.\n\nWhen applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate.\n\nIn addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances:\n\n(i) When authenticators change;\n(ii) When roles change;\n(iii) When security categories of information systems change;\n(iv) When the execution of privileged functions occurs;\n(v) After a fixed period of time; or\n(vi) Periodically.\n\nWithin the DOD, the minimum circumstances requiring reauthentication are privilege escalation and role changes.","checkContent":"Select Settings >> Server Settings >> General Settings and verify that Session timeout is set to 15 minutes or less.\n\nIf Splunk is not configured to 15 minutes or less, this is a finding.","fixText":"Select Settings >> Server Settings >> General Settings and set Session timeout to 15 minutes or less.","ccis":["CCI-004895","CCI-002038"]},{"vulnId":"V-221938","ruleId":"SV-221938r1043182_rule","severity":"medium","ruleTitle":"Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.","description":"Automatic session termination after a period of inactivity addresses the potential for a malicious actor to exploit the unattended session. Closing any unattended sessions reduces the attack surface to the application.","checkContent":"Select Settings >> Server Settings >> General Settings and verify that Session timeout is set to 15 minutes or less.\n\nIf Splunk is not configured to 15 minutes or less, this is a finding.","fixText":"Select Settings >> Server Settings >> General Settings and set Session timeout to 15 minutes or less.","ccis":["CCI-002361"]},{"vulnId":"V-221939","ruleId":"SV-221939r1015827_rule","severity":"low","ruleTitle":"Splunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, disabling).","description":"Once an attacker establishes access to an application, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create a new account. Sending notification of account creation events to the SA and ISSO is one method for mitigating this risk.\n\nTo address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to offload those access control functions and focus on core application features and functionality.\n\nSatisfies: SRG-APP-000291-AU-000200, SRG-APP-000292-AU-000420, SRG-APP-000293-AU-000430, SRG-APP-000294-AU-000440","checkContent":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is Not Applicable.\n\nInterview the SA to verify that a process exists to notify the SA and ISSO when account events are received for all devices and hosts within its scope of coverage.\n\nInterview the ISSO to confirm receipt of this notification.\n\nIf Splunk Enterprise is not configured to notify the SA and ISSO when account events are received for all devices and hosts within its scope of coverage, this is a finding.","fixText":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this fix is Not Applicable.\n\nConfigure Splunk Enterprise, using the reporting and notification tools, to notify the SA and ISSO when account events are received for all devices and hosts within its scope of coverage.","ccis":["CCI-000015","CCI-001683","CCI-001684","CCI-001685","CCI-001686"]},{"vulnId":"V-221940","ruleId":"SV-221940r1015828_rule","severity":"low","ruleTitle":"Splunk Enterprise must notify analysts of applicable events for Tier 2 CSSP and JRSS only.","description":"Sending notifications or populating dashboards are ways to monitor and alert on applicable events and allow analysts to mitigate issues.\n\nTier 2 CSSP and JRSS analysts perform higher-level analysis at larger network coverage and have specific guidelines to handle alerts and reports. This requirement allows these analysts to not be burdened by all of the lower-level alerts that can be considered \"white noise\" by isolating their alerting and reporting requirements from other requirements in this STIG.\n\nSatisfies: SRG-APP-000291-AU-000200, SRG-APP-000292-AU-000420, SRG-APP-000293-AU-000430, SRG-APP-000294-AU-000440","checkContent":"This check applies to Tier 2 CSSP or JRSS instances only.\n\nVerify that notifications and dashboards are configured in accordance with designated SSPs, SOPs, and/or TTPs.\n\nThe absence of notifications and dashboards is a finding.","fixText":"This fix applies to Tier 2 CSSP or JRSS instances only.\n\nConfigure Splunk notifications and dashboards in accordance with designated SSPs, SOPs, and/or TTPs.","ccis":["CCI-000015","CCI-001683","CCI-001684","CCI-001685","CCI-001686"]},{"vulnId":"V-221941","ruleId":"SV-221941r960840_rule","severity":"medium","ruleTitle":"Splunk Enterprise must enforce the limit of 3 consecutive invalid logon attempts by a user during a 15 minute time period.","description":"By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.\n\nIn most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.","checkContent":"Select Settings >> Access Controls >> Password Policy Management.\n\nVerify that Lockout is Enabled, Failed login attempts is set to 3, and Lockout threshold in minutes is set to 15.\n\nIf these settings are not set as described, this is a finding.","fixText":"Select Settings >> Access Controls >> Password Policy Management.\n\nSet Lockout to Enabled. Set Failed login attempts to 3 and Lockout threshold in minutes to 15.","ccis":["CCI-000044"]},{"vulnId":"V-221942","ruleId":"SV-221942r961824_rule","severity":"medium","ruleTitle":"Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report.","description":"The SIEM or Central Log Server is the mitigation method for most of the other STIGs applied to an organization. Robust alerting and reporting is a key feature in any incident response plan.\n\nThe ability to report on logon attempts is the first step is creating a chain of events for a forensic analysis and incident response.","checkContent":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is N/A.\n\nInterview the System Administrator (SA) to demonstrate that a logon attempts report exists.\n\nIf a report does not exist, this is a finding.","fixText":"If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this fix is N/A.\n\nConfigure Splunk Enterprise using the reporting and notification tools to create a report that audits the logon attempts. Make this report available to the ISSM and other required individuals.","ccis":["CCI-000172"]},{"vulnId":"V-246917","ruleId":"SV-246917r960891_rule","severity":"low","ruleTitle":"The System Administrator (SA) and Information System Security Officer (ISSO) must configure the retention of the log records based on the defined security plan.","description":"If authorized individuals do not have the ability to modify auditing parameters in response to a changing threat environment, the organization may not be able to respond effectively and important forensic information may be lost.\n\nThe organization must define and document log retention requirements for each device and host and then configure Splunk Enterprise to comply with the required retention period.\n\nThis requirement enables organizations to extend or limit auditing as necessary to meet organizational requirements. Auditing that is limited to conserve information system resources may be extended to address certain threat situations.","checkContent":"Examine the site documentation for the retention time for log data.\n\nExamine the following file in the Splunk installation folder:\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\n$SPLUNK_HOME/etc/system/local/indexes.conf\n\nFor each index defined in the scope, the frozenTimePeriodInSecs setting must match the site documentation.\n\nIf the settings do not match, this is a finding.","fixText":"Edit the following file in the Splunk installation folder:\n\n(Note that these files may exist in one of the following folders or its subfolders:\n$SPLUNK_HOME/etc/apps/\n$SPLUNK_HOME/etc/slave-apps/)\n\n$SPLUNK_HOME/etc/system/local/indexes.conf\n\nSet frozenTimePeriodInSecs to the defined retention period for each index location.","ccis":["CCI-001914"]},{"vulnId":"V-274464","ruleId":"SV-274464r1099921_rule","severity":"high","ruleTitle":"Splunk Enterprise must use a version supported by the vendor.","description":"Running unsupported software increases risk of unresolved vulnerabilities and system damage. Software must be currently maintained by the vendor to patch vulnerabilities.","checkContent":"This STIG is sunset and no longer maintained.\n\nCheck that the version in use is still supported by the vendor.\n\nIf the version in use is not supported by the vendor, this is a finding.","fixText":"Upgrade to a version supported by the vendor.","ccis":["CCI-002605"]}]}