Hello,
I’m a Splunk admin supporting a government environment. We’ve historically used both the STIGs and the SRGs to help meet compliance requirements.
With Splunk STIGs 7.x and 8.x now sunset, I’m trying to understand whether Cisco plans to publish an updated set of STIGs for newer Splunk versions. At the moment, the SRG appears to reference a Centralized Log Server rather than Splunk specifically, which leaves some room for interpretation.
I’m interested in whether anyone has seen official guidance, an updated roadmap, or any discussion around compliance support for current Splunk Enterprise releases.
A few specific questions:
- Is Cisco planning to release updated STIGs for supported Splunk versions?
- If not, is the expectation that organizations should map current Splunk deployments to the existing Centralized Log Server SRG?
- Has anyone successfully navigated compliance or accreditation for newer Splunk versions using the SRG alone?
- Are there any accepted best practices, overlays, or compensating control approaches the community is using in the absence of updated Splunk-specific STIGs?
