STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must generate log records for authentication and authorization events.

DISA Rule

SV-250350r961812_rule

Vulnerability Number

V-250350

Group Title

SRG-APP-000499-AS-000224

Rule Version

IBMW-LS-001190

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-001464 - Initiates session audits automatically at system start-up.

Weight

10

Fix Recommendation

Modify the ${server.config.dir}/server.xml file and configure the audit-1.0 feature.

<featureManager>
<feature>audit-1.0</feature>
</featureManager>

Configure the auditFileHandler setting to record SECURITY_AUTHN and SECURITY_AUTHZ events.

<auditFileHandler>
<events name="AllAuthn" eventName="SECURITY_AUTHN"/>
<events name="AllAuthz" eventName="SECURITY_AUTHZ" />
</auditFileHandler>

Review audit logs located under the ${server.config.dir}/logs directory and ensure AUTHN and AUTHZ events are logged.

Check Contents

Review the ${server.config.dir}/server.xml file, verify the audit-1.0 feature is enabled. Also verify the auditFile Handler is configured to log AUTHN and AUTHZ events.

If the audit1.0 feature is not enabled, this is a finding.

If the SECURITY_AUTHN and SECURITY_AUTHZ event handlers are not configured, this is a finding.

<featureManager>
<feature>audit-1.0</feature>
</featureManager>

<auditFileHandler>
<events name="AllAuthn" eventName="SECURITY_AUTHN" />
<events name="AllAuthz" eventName="SECURITY_AUTHZ" />
</auditFileHandler>

Vulnerability Number

V-250350

Documentable

False

Rule Version

IBMW-LS-001190

Severity Override Guidance

Review the ${server.config.dir}/server.xml file, verify the audit-1.0 feature is enabled. Also verify the auditFile Handler is configured to log AUTHN and AUTHZ events.

If the audit1.0 feature is not enabled, this is a finding.

If the SECURITY_AUTHN and SECURITY_AUTHZ event handlers are not configured, this is a finding.

<featureManager>
<feature>audit-1.0</feature>
</featureManager>

<auditFileHandler>
<events name="AllAuthn" eventName="SECURITY_AUTHN" />
<events name="AllAuthz" eventName="SECURITY_AUTHZ" />
</auditFileHandler>

Check Content Reference

M

Target Key

5424