← Back to Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

V-221613

CAT II (Medium)

Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.

Rule ID

SV-221613r960864_rule

STIG

Splunk Enterprise 7.x for Windows Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000166

Discussion

Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual). The records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so.

Check Content

If the server being reviewed does not store index data, this check is N/A.

Check the following file in the installation folder:

$SPLUNK_HOME/etc/system/local/indexes.conf

Verify that each organization-defined index stanza in brackets [ ] has the following line added:

enableDataIntegrityControl=true

If this line is missing or is set to false, this is a finding.

Fix Text

If the server does not store index data, this fix is N/A.

Edit the following file in the installation folder:

$SPLUNK_HOME/etc/system/local/indexes.conf

Add the following line to each organization-defined index stanza in brackets [ ]:

enableDataIntegrityControl=true