Splunk Enterprise must be configured to back up the log records repository at least every seven days onto a different system or system component other than the system or component being audited.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-221612
SPLK-CL-000105
SV-221612r960948_rule
Low
Description
Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to a different system or onto separate media than the system being audited on an organizationally defined frequency helps to ensure that in the event of a catastrophic system failure, the log records will be retained.
This helps to ensure that a compromise of the information system being audited does not also result in a compromise of the log records.
This requirement only applies to applications that have a native backup capability for log records. Operating system backup requirements cover applications that do not provide native backup functions.
Interview the SA to verify that a process exists to back up the Splunk log data every seven days, using the underlying OS backup tools, or another approved backup tool.
If a backup plan does not exist for the Splunk log data, this is a finding.
Fix Text (F-23316r416294_fix)
Implement a backup plan for the Splunk log data, following the Splunk documentation on backing up indexed data. Use the underlying OS backup tools, or another approved backup tool.