Checklist Summary:

This Splunk Enterprise 7.x for Windows Security Technical Implementation Guide (STIG) provides the technical security policies, requirements, and implementation details for deploying a hardened, secure Splunk instance in the organization. Splunk Enterprise is a Security Information and Event Management (SIEM) product that enables the organization to collect, search, analyze, and report on any application, machine, or device data, such as Syslog, operating system events, websites, etc. Analyzing application, machine, and device data is a valuable forensic tool for maintaining organization confidentiality, integrity, and availability. A SIEM product such as Splunk Enterprise is an expansion of the Central Log Server, and as such is often the mitigation point for logging requirements for other STIGs deployed in an organization. Because of this designation, several of the STIG requirements in this package address auditing and reporting of those upstream systems. The ability to provide robust incident reports and alert notifications of events is what makes a SIEM product such as Splunk Enterprise a valuable tool for organizational security. This STIG is written for the Windows environment and excludes Linux platforms at this time.

Checklist Role:

• Database Management System

Known Issues:

Not provided.

Target Audience:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Target Operational Environment:

• Specialized Security-Limited Functionality (SSLF)
• Managed

Testing Information:

Not provided.

Regulatory Compliance:

DoDI 8500.01

Comments/Warnings/Miscellaneous:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Disclaimer:

Not provided.

Product Support:

Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. DISA will coordinate all change requests with the relevant DoD organizations before inclusion in this document. Approved changes will be made in accordance with the DISA maintenance release schedule.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

Updated to Final - 7/6/2020
Updated URL per DISA - 10/28/20
Updated SHA - 11/5/2020
updated URLs - 4/28/2021
Updated resource - 8/9/21
null
Updated URLs per DISA - 7/25/23

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 07/25/2023