Splunk Enterprise idle session timeout must be set to not exceed 15 minutes.

Automatic session termination after a period of inactivity addresses the potential for a malicious actor to exploit the unattended session. Closing any unattended sessions reduces the attack surface to the application.

Select Settings >> Server Settings >> General Settings and verify that Session timeout is set to 15 minutes or less.

If Splunk is not configured to 15 minutes or less, this is a finding.

Select Settings >> Server Settings >> General Settings and set Session timeout to 15 minutes or less.