← Back to Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

V-221936

CAT III (Low)

Splunk Enterprise forwarders must be configured with Indexer Acknowledgement enabled.

Rule ID

SV-221936r961863_rule

STIG

Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

To prevent the loss of data during transmission, a handshake acknowledgement between the sender and the recipient may need configured.

Check Content

If the server being reviewed is not a forwarder, this check is N/A.

In the Splunk installation folder, check the following file in the $SPLUNK_HOME/etc/system/local folder:

outputs.conf

Locate the section similar to: 

[tcpout:group1]
useACK=true

Note that group1 may be named differently depending on how tcpout was configured.

If the useACK=true statement is missing or set to false, this is a finding.

Fix Text

If the server is not a forwarder, this check is N/A.

In the Splunk installation folder, edit the following file in the $SPLUNK_HOME/etc/system/local folder:

outputs.conf

Locate the section similar to: 

[tcpout:group1]

Note that group1 may be named differently depending on how tcpout was configured.

Add the following line under the group stanza above:

useACK=true