The WebSphere Liberty Server must log remote session and security activity.
DISA Rule
SV-250325r1015250_rule
Vulnerability Number
V-250325
Group Title
SRG-APP-000016-AS-000013
Rule Version
IBMW-LS-000040
Severity
CAT II
CCI(s)
- CCI-000067 - Employ automated mechanisms to monitor remote access methods.
- CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
- CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
- CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
- CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
- CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
- CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
- CCI-000162 - Protect audit information from unauthorized access.
- CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
- CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
- CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
- CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.
- CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
- CCI-002234 - Log the execution of privileged functions.
Weight
10
Fix Recommendation
To log remote access events, the featureManager setting in the ${server.config.dir}/server.xml must contain the audit and appSecurity features.
<featureManager>
<feature>audit-1.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>
Check Contents
Review the ${server.config.dir}/server.xml file and ensure audit-1.0 and appSecurity-2.0 are defined within the <featureManager> setting in the server.xml file.
If audit-1.0 and appSecurity-2.0 are not defined within the <featureManager> setting in the server.xml file, this is a finding.
EXAMPLE:
<featureManager>
<feature>audit-1.0</feature>
<feature>appSecurity-3.0</feature>
</featureManager>
Vulnerability Number
V-250325
Documentable
False
Rule Version
IBMW-LS-000040
Severity Override Guidance
Review the ${server.config.dir}/server.xml file and ensure audit-1.0 and appSecurity-2.0 are defined within the <featureManager> setting in the server.xml file.
If audit-1.0 and appSecurity-2.0 are not defined within the <featureManager> setting in the server.xml file, this is a finding.
EXAMPLE:
<featureManager>
<feature>audit-1.0</feature>
<feature>appSecurity-3.0</feature>
</featureManager>
Check Content Reference
M
Target Key
5424
STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026: