U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Splunk Enterprise 8.x for Linux Ver 1, Rel 5 Checklist Details (Checklist Revisions)

Supporting Resources:

Target:

Target CPE Name
Splunk Enterprise 8.0.0 cpe:/a:splunk:splunk:8.0.0::~~enterprise~~~ (View CVEs)

Checklist Highlights

Checklist Name:
Splunk Enterprise 8.x for Linux
Checklist ID:
1016
Version:
Ver 1, Rel 5
Type:
Vulnerability
Review Status:
Final
Authority:
Governmental Authority: Defense Information Systems Agency
Original Publication Date:
11/14/2021

Checklist Summary:

This Splunk Enterprise 8.x for Linux Security Technical Implementation Guide (STIG) provides the technical security policies, requirements, and implementation details for deploying a hardened, secure Splunk instance in the organization. Splunk Enterprise is a Security Information and Event Management (SIEM) product that enables the organization to collect, search, analyze, and report on any application, machine, or device data, such as Syslog, operating system events, websites, etc. Analyzing application, machine, and device data is a valuable forensic tool for maintaining organization confidentiality, integrity, and availability. A SIEM product such as Splunk Enterprise is an expansion of the Central Log Server, and as such is often the mitigation point for logging requirements for other STIGs deployed in an organization. Because of this designation, several of the STIG requirements in this package address auditing and reporting of those upstream systems. The ability to provide robust incident reports and alert notifications of events makes a SIEM product such as Splunk Enterprise a valuable tool for organizational security.

Checklist Role:

  • Database Management System

Known Issues:

Not provided.

Target Audience:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Target Operational Environment:

  • Managed
  • Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

This document is provided under the authority of DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

corrected title - 2/1/22
updated status to final - 3/2/2022
Updated resource per DISA - 4/24/22
updated URLs - 4/27/2022
Updated resource per DISA - 8/1/22
Updated URLs per DISA - 7/25/23
Updated resource per DISA - 10/26/23

Dependency/Requirements:

URL Description

References:

Reference URL Description

NIST checklist record last modified on 10/26/2023