Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-221613 | SRG-APP-000080-AU-000010 | SPLK-CL-000160 | SV-221613r960864_rule | 2024-08-27 | 3 |
Description
Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual).
The records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so.
ℹ️ Check
If the server being reviewed does not store index data, this check is N/A.
Check the following file in the installation folder:
$SPLUNK_HOME/etc/system/local/indexes.conf
Verify that each organization-defined index stanza in brackets [ ] has the following line added:
enableDataIntegrityControl=true
If this line is missing or is set to false, this is a finding.
✔️ Fix
If the server does not store index data, this fix is N/A.
Edit the following file in the installation folder:
$SPLUNK_HOME/etc/system/local/indexes.conf
Add the following line to each organization-defined index stanza in brackets [ ]:
enableDataIntegrityControl=true