← Back to Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

V-221938

CAT II (Medium)

Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

Rule ID

SV-221938r1043182_rule

STIG

Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-002361

Discussion

Automatic session termination after a period of inactivity addresses the potential for a malicious actor to exploit the unattended session. Closing any unattended sessions reduces the attack surface to the application.

Check Content

Select Settings >> Server Settings >> General Settings and verify that Session timeout is set to 15 minutes or less.

If Splunk is not configured to 15 minutes or less, this is a finding.

Fix Text

Select Settings >> Server Settings >> General Settings and set Session timeout to 15 minutes or less.