Rule version SPLK-CL-000175 · STIG v3 · 2024-08-27
To prevent the loss of data during transmission, a handshake acknowledgement between the sender and the recipient may need configured.
If the server being reviewed is not a forwarder, this check is N/A.
In the Splunk installation folder, check the following file in the $SPLUNK_HOME/etc/system/local folder:
outputs.conf
Locate the section similar to:
[tcpout:group1] useACK=true
Note that group1 may be named differently depending on how tcpout was configured.
If the useACK=true statement is missing or set to false, this is a finding.
If the server is not a forwarder, this check is N/A.
In the Splunk installation folder, edit the following file in the $SPLUNK_HOME/etc/system/local folder:
outputs.conf
Locate the section similar to:
[tcpout:group1]
Note that group1 may be named differently depending on how tcpout was configured.
Add the following line under the group stanza above:
useACK=true