STIGQter: STIG Summary: Splunk Enterprise 7.x for Windows Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

Splunk Enterprise must be configured with a successful/unsuccessful logon attempts report.

DISA Rule

SV-221942r508660_rule

Vulnerability Number

V-221942

Group Title

SRG-APP-000503-AU-000280

Rule Version

SPLK-CL-000280

Severity

CAT II

CCI(s)

• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Weight

10

Fix Recommendation

If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this fix is N/A.

Configure Splunk Enterprise using the reporting and notification tools to create a report that audits the logon attempts. Make this report available to the ISSM and other required individuals.

Check Contents

If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is N/A.

Interview the System Administrator (SA) to demonstrate that a logon attempts report exists.

If a report does not exist, this is a finding.

Vulnerability Number

V-221942

Documentable

False

Rule Version

SPLK-CL-000280

Severity Override Guidance

If the Splunk instance is used for Tier 2 CSSP (formerly CND-SP) or JRSS analysis, this check is N/A.

Interview the System Administrator (SA) to demonstrate that a logon attempts report exists.

If a report does not exist, this is a finding.

Check Content Reference

M

Target Key

4082

Comments