← Back to Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

V-221614

CAT II (Medium)

Splunk Enterprise must use TCP for data transmission.

Rule ID

SV-221614r961863_rule

STIG

Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

If the UDP protocol is used for communication, then data packets that do not reach the server are not detected as a data loss. The use of TCP to transport data improves delivery reliability, adds data integrity, and gives the option to encrypt the traffic.

Check Content

Select Settings >> Data Inputs, and verify there are zero inputs configured under UDP. Splunk supports UDP, but it is not permissible to use. 

If any exist, this is a finding.

If the Web UI is disabled, open an OS command prompt and type:

netstat -a -p UDP

If a UDP connection is displayed for 0.0.0.0:514, the instance is listening for Syslog port 514 in UDP, and this is a finding.

Fix Text

Select Settings >> Data Inputs, and verify there are zero inputs configured under UDP. Remove any that exist and recreate using TCP.

It is recommended to set these settings before disabling the web UI of the instance in a distributed environment.