Splunk Enterprise must accept the DOD CAC or other PKI credential for identity management and personal authentication.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-251692	SRG-APP-000391-AU-002290	SPLK-CL-000490	SV-251692r992052_rule	2025-03-05	2

Description
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DOD has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as a primary component of layered protection for national security systems. DOD has approved other methods of PKI, including YubiKey, RSA tokens, etc. If the application cannot meet this requirement, the risk may be mitigated through use of an authentication server.

Description

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DOD has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as a primary component of layered protection for national security systems. DOD has approved other methods of PKI, including YubiKey, RSA tokens, etc. If the application cannot meet this requirement, the risk may be mitigated through use of an authentication server.

ℹ️ Check
If the instance being checked is in a distributed environment and has the web interface disabled, this check is Not Applicable. Verify that Splunk Enterprise is configured to use the DOD CAC or other PKI credential to log in to the application. If it is not configured to allow the use of the DOD CAC or other PKI credential, this is a finding.

✔️ Fix
Configure an SSO proxy service using Apache, IIS, F5, SAML, etc., to provide PKI credentials to Splunk Enterprise. Examples for Apache and F5 are provided using the supplemental documentation included in this package to be used in addition to the Splunk documentation.