OpenControls Logo

STIG Viewer

STIGViewer Support

The WebSphere Application Server audit service provider must be enabled.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-81211WBSP-AS-000110SV-95925r1_ruleCCI-000067medium
Description
Logging must be utilized in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident. Remote access by administrators requires that the admin activity be logged. Application servers provide a web and command line-based remote management capability for managing the application server. Application servers must ensure that all actions related to administrative functionality such as application server configuration are logged. Satisfies: SRG-APP-000016-AS-000013, SRG-APP-000343-AS-000030
STIGDate
IBM WebSphere Traditional V9.x Security Technical Implementation Guide2018-08-24

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.4Auditing Use of Privileged Functions
1.00
NET-14.1Automated Monitoring & Control
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (40) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(3)Mandatory Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00

+30 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.12
1.00
3.1.7
1.00
CCI2 mappings
CCI-000067
1.00
CCI-002234
1.00

Details

Check Text (C-95925r1_chk)

In the administrative console, navigate to Security >> Security auditing >> Audit Service Provider [provider name]. Under "Enabled filters", determine if the filter name from select the name of the filter that was recorded from STIG ID WBSP-AS-000100. If the filter that was identified in STIG ID WBSP-AS-000100 is not enabled, this is a finding.

Fix Text (F-87989r1_fix)

In the administrative console, navigate to Security >> Security auditing >> Event type Filters. Identify and record the event type filter that contains the required "Events and Outcomes". In the administrative console, click on Security >> Security auditing >> Audit Service Provider [provider name]. Under "Selectable filters", select the filter that was previously identified and recorded. Click the right arrow to add it to the list. Click "OK". Click "Save" to save the changes. Restart the DMGR and all the JVMs.