STIGQter STIGQter: STIG Summary: Splunk Enterprise 7.x for Windows Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

Splunk Enterprise must use an SSO proxy service, F5 device, or SAML implementation to accept the DoD CAC or other smart card credential for identity management, personal authentication, and multifactor authentication.

DISA Rule

SV-221605r663928_rule

Vulnerability Number

V-221605

Group Title

SRG-APP-000391-AU-002290

Rule Version

SPLK-CL-000045

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure an SSO proxy service using Apache, IIS, F5, SAML, etc., to provide CAC credentials to Splunk Enterprise.

Examples for Apache and F5 are provided using the supplemental documentation included in this package to be used in addition to the Splunk documentation.

Check Contents

If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.

Verify that Splunk Enterprise is configured to use the DoD CAC credential to log into the application.

If it is not configured to allow the use of the DoD CAC credential, this is a finding.

Vulnerability Number

V-221605

Documentable

False

Rule Version

SPLK-CL-000045

Severity Override Guidance

If the instance being checked is in a distributed environment and has the web interface disabled, this check is N/A.

Verify that Splunk Enterprise is configured to use the DoD CAC credential to log into the application.

If it is not configured to allow the use of the DoD CAC credential, this is a finding.

Check Content Reference

M

Target Key

4082

Comments