Checklist Summary:

This Splunk Enterprise 8.x for Linux Security Technical Implementation Guide (STIG) provides the technical security policies, requirements, and implementation details for deploying a hardened, secure Splunk instance in the organization. Splunk Enterprise is a Security Information and Event Management (SIEM) product that enables the organization to collect, search, analyze, and report on any application, machine, or device data, such as Syslog, operating system events, websites, etc. Analyzing application, machine, and device data is a valuable forensic tool for maintaining organization confidentiality, integrity, and availability. A SIEM product such as Splunk Enterprise is an expansion of the Central Log Server, and as such is often the mitigation point for logging requirements for other STIGs deployed in an organization. Because of this designation, several of the STIG requirements in this package address auditing and reporting of those upstream systems. The ability to provide robust incident reports and alert notifications of events makes a SIEM product such as Splunk Enterprise a valuable tool for organizational security.

Checklist Role:

• Database Management System

Known Issues:

Not provided.

Target Audience:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

This document is provided under the authority of DoDI 8500.01.

Comments/Warnings/Miscellaneous:

Not provided.

Disclaimer:

Not provided.

Product Support:

Not provided.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

corrected title - 2/1/22
updated status to final - 3/2/2022
Updated resource per DISA - 4/24/22
updated URLs - 4/27/2022
Updated resource per DISA - 8/1/22
Updated URLs per DISA - 7/25/23
Updated resource per DISA - 10/26/23
Updated Version, Resources and SHA - 08/08/2024

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 08/08/2024