STIGQter: STIG Summary: Splunk Enterprise 7.x for Windows Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

When Splunk Enterprise is distributed over multiple servers, each server must be configured to disable non-essential capabilities.

DISA Rule

SV-221934r508660_rule

Vulnerability Number

V-221934

Group Title

SRG-APP-000141-AU-000090

Rule Version

SPLK-CL-000090

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

If the Splunk Installation is not distributed among multiple servers, this fix is N/A.

Select Settings >> Monitoring Console.

In the Monitoring Console, select Settings >> General Setup.

Set the Mode type based on the implementation design.

If Mode is set to Distributed, set each instance only with the server roles necessary for the desired functions.

On instances not designated as search heads, disable the web UI by using the following command:

./splunk disable webserver

On instances not designated as indexers, remove the file:

$SPLUNK_HOME/etc/system/local/indexes.conf

Check Contents

If the Splunk Installation is not distributed among multiple servers, this check is N/A.

If the machine being reviewed is not designated as a search head, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/web.conf

Check for the following lines:

[settings]
startwebserver = 0

If the startwebserver = 0 line is missing, or is = 1, this is a finding.

If the machine being reviewed is not designated as an indexer, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/indexes.conf

If this file exists, this is a finding.

This file should only exist on an instance designated as an indexer.

Vulnerability Number

V-221934

Documentable

False

Rule Version

SPLK-CL-000090

Severity Override Guidance

If the Splunk Installation is not distributed among multiple servers, this check is N/A.

If the machine being reviewed is not designated as a search head, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/web.conf

Check for the following lines:

[settings]
startwebserver = 0

If the startwebserver = 0 line is missing, or is = 1, this is a finding.

If the machine being reviewed is not designated as an indexer, check the following file in the Splunk installation folders:

$SPLUNK_HOME/etc/system/local/indexes.conf

If this file exists, this is a finding.

This file should only exist on an instance designated as an indexer.

Check Content Reference

M

Target Key

4082

Comments