Splunk Enterprise must be configured to protect the log data stored in the indexes from alteration.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-251662 | SRG-APP-000080-AU-000010 | SPLK-CL-000090 | SV-251662r960864_rule | 2025-03-05 | 2 |
| Description |
|---|
| Without non-repudiation, it is impossible to positively attribute an action to an individual (or process acting on behalf of an individual). The records stored by Splunk Enterprise must be protected against alteration. A hash is one way of performing this function. The server must not allow the removal of identifiers or date/time, or it must severely restrict the ability to do so. |
| ℹ️ Check |
|---|
| This check is performed on the machine used as an indexer, which may be a separate machine in a distributed environment. If the instance being reviewed is not used as an indexer, this check is N/A. Examine the configuration. Navigate to the $SPLUNK_HOME/etc/system/local/ directory. View the indexes.conf file. If the indexes.conf file does not exist, this is a finding. If the "enableDataIntegrityControl" is missing or is configured to 0 or false for each index, this is a finding. |
| ✔️ Fix |
|---|
| If the indexes.conf file does not exist, copy the file from $SPLUNK_HOME/etc/system/default to the $SPLUNK_HOME/etc/system/local directory. Modify the following lines in the indexes.conf file under each index: enableDataIntegrityControl = 1 or True |