STIGQter: STIG Summary: Oracle WebLogic Server 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle WebLogic must produce process events and security levels to establish what type of Oracle WebLogic process events and severity levels occurred.

DISA Rule

SV-235944r628610_rule

Vulnerability Number

V-235944

Group Title

SRG-APP-000095-AS-000056

Rule Version

WBLC-02-000075

Severity

CAT III

CCI(s)

• CCI-000130 - The information system generates audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. From the list of servers, select one which needs AS process logging configured
4. Utilize 'Change Center' to create a new change session
5. From 'Logging' tab -> 'General' tab, set the 'Log file name' field to 'logs/<server-name>.log
6. Click 'Save', and from 'Change Center' click 'Activate Changes' to enable configuration changes

Check Contents

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Logs' -> 'View Log Messages'
3. Within the 'Search' panel, expand 'Selected Targets'
4. Click 'Target Log Files' icon for 'AdminServer' target
5. From the list of log files, select '<server-name>.log' and click 'View Log File' button
6. All AS process logging of the AdminServer will be displayed
7. Repeat for each managed server

If the managed servers or AdminServer does not have process events, this is a finding.

Vulnerability Number

V-235944

Documentable

False

Rule Version

WBLC-02-000075

Severity Override Guidance

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Logs' -> 'View Log Messages'
3. Within the 'Search' panel, expand 'Selected Targets'
4. Click 'Target Log Files' icon for 'AdminServer' target
5. From the list of log files, select '<server-name>.log' and click 'View Log File' button
6. All AS process logging of the AdminServer will be displayed
7. Repeat for each managed server

If the managed servers or AdminServer does not have process events, this is a finding.

Check Content Reference

M

Target Key

5282

Comments