What changed in Splunk Enterprise 8.x for Linux STIG V2R2V2R2 changes

Splunk Enterprise 8.x for Linux STIG V2R2 (2025-04-02) replaced V2R1 (2024-07-24): 9 checks updated. It has 36 checks, against 36 in V2R1.

V2R2 checklistV2R1 checklist Compare V2R1 and V2R2 in STIG Compare

  • 0 added
  • 0 removed
  • 9 updated

Updated fields: CCIs 8Check text 1Fix text 1

Updated in V2R2 (9)

V-251657CAT IISplunk Enterprise idle session timeout must be set to not exceed 15 minutes.CCIs

CCIs

CCI-004895,CCI-002361,CCI-002038

V-251657 in V2R2

V-251658CAT IIISplunk Enterprise must notify the system administrator (SA) and information system security officer (ISSO) when account events are received (creation, deletion, modification, or disabling).CCIs

CCIs

CCI-000015CCI-000015,CCI-001683,CCI-001684,CCI-001685,CCI-001686

V-251658 in V2R2

V-251681CAT IIISplunk Enterprise must be configured to enforce password complexity by requiring that at least one uppercase character be used.CCIs

CCIs

CCI-004066CCI-004066,CCI-000192

V-251681 in V2R2

V-251682CAT IIISplunk Enterprise must be configured to enforce password complexity by requiring that at least one lowercase character be used.CCIs

CCIs

CCI-004066CCI-004066,CCI-000193

V-251682 in V2R2

V-251683CAT IIISplunk Enterprise must be configured to enforce password complexity by requiring that at least one numeric character be used.CCIs

CCIs

CCI-004066CCI-004066,CCI-000194

V-251683 in V2R2

V-251684CAT IIISplunk Enterprise must be configured to enforce a minimum 15-character password length.CCIs

CCIs

CCI-004066CCI-004066,CCI-000205

V-251684 in V2R2

V-251685CAT IIISplunk Enterprise must be configured to enforce password complexity by requiring that at least one special character be used.CCIs

CCIs

CCI-004066CCI-004066,CCI-001619

V-251685 in V2R2

V-251687CAT IIISplunk Enterprise must be configured to enforce a 60-day maximum password lifetime restriction.CCIs

CCIs

CCI-004066CCI-004066,CCI-000199

V-251687 in V2R2

V-251689CAT ISplunk Enterprise must use TLS 1.2 and SHA-2 or higher cryptographic algorithms.Check text, Fix text

Check text

Examine the configuration. Check the following files in the $SPLUNK_HOME/etc/system/local folder: inputs.conf : Check is applicable to the indexer which may be a separate machine in a distributed environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or itthis is a finding: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 outputs.conf : Check is applicable to the forwarder, which is always a separate machine in the environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or itthis is a finding: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 server.conf CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or it is a finding: sslVersions = tls1.2 sslVersionsForClient = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 web.conf : Check is applicable to search head or deployment server, which may be a separate machine in a distributed environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or it is a finding: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 Check the following file in the /etc/openldap folder: ldap.conf Check for the following lines, they must match the settings below or it is a finding: #TLS_PROTOCOL_MIN: 3.1 for TLSv1.0, 3.2 for TLSv1.1, 3.3 for TLSv1.2. TLS_PROTOCOL_MIN 3.3 TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 Note: Splunk Enterprise must operate in FIPS mode to limit the algorithms allowed.

Fix text

Edit the following files in the $SPLUNK_HOME/etc/system/local folder: inputs.conf : Fix is applicable to the indexer, which may be a separate machine in a distributed environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or be removed: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 outputs.conf : Check is applicable to the forwarder which is always a separate machine in the environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or be removed: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 server.conf CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or be removed: sslVersions = tls1.2 sslVersionsForClient = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 web.conf : Check is applicable to search head or deployment server, which may be a separate machine in a distributed environment. CheckIf for the following lines, if they do not exist, then the settings are compliant. If they exist, they must match the settings below or be removed: sslVersions = tls1.2 ciphersuitecipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 Check the following file in the /etc/openldap folder: ldap.conf Check for the following lines, set to match the settings below: #TLS_PROTOCOL_MIN: 3.1 for TLSv1.0, 3.2 for TLSv1.1, 3.3 for TLSv1.2. TLS_PROTOCOL_MIN 3.3 TLS_CIPHER_SUITE ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM- SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA- AES128-SHA256:ECDHE-RSA-AES128-SHA256 Note: Splunk Enterprise must operate in FIPS mode to limit the algorithms allowed.

V-251689 in V2R2

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.