STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

ColdFusion must be configured to support integration with a third-party Security Information and Event Management (SIEM) to support notifications.

DISA Rule

SV-279070r1172833_rule

Vulnerability Number

V-279070

Group Title

SRG-APP-000231-AS-000156

Rule Version

APAS-CF-000490

Severity

CAT II

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-000139 - Alert organization-defined personnel or roles within an organization-defined time period in the event of an audit logging process failure.
• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
• CCI-001350 - Implement cryptographic mechanisms to protect the integrity of audit information.
• CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
• CCI-001496 - Implement cryptographic mechanisms to protect the integrity of audit tools.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
• CCI-003831 - Alert organization-defined personnel or roles upon detection of unauthorized access, modification, or deletion of audit information.

Weight

10

Fix Recommendation

Configure SIEM.

1. Create /etc/rsyslog.d/101-<instance name>.conf for each of the configured ColdFusion instances with these contents, ensuring the final line points to a valid syslog server.

Example:
module(load="imfile" PollingInterval="10")
cat > /etc/rsyslog.d/101-cfusion.conf << EOF

module(load="imfile" PollingInterval="10")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/coldfusion-out.log"
Tag="coldfusion-out"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/coldfusion-error.log"
Tag="coldfusion-error"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/cfpm-audit.log"
Tag="cfpm-audit"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/audit.log"
Tag="audit"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/http.log"
Tag="http"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/mail.log"
Tag="mail"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/monitor.log"
Tag="monitor"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/server.log"
Tag="server"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/usagedata.log"
Tag="usagedata"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/update.log"
Tag="update"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/application.log"
Tag="application"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/exception.log"
Tag="exception"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/reporting.log"
Tag="reporting"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/axis2.log"
Tag="axis2"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/eventgateway.log"
Tag="eventgateway"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/license.log"
Tag="license"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/security.log"
Tag="security"
Facility="cfusion")

input(type="imfile"
File="/opt/coldfusion2023/cfusion/logs/webservice.log"
Tag="webservice"
Facility="cfusion")

2. Add the following to /etc/rsyslog.conf:
*.* action(type="omfwd" target="<remote rsyslog IP address>" port="10514" protocol="tcp")

3. Restart rsyslog to apply changes: sudo systemctl restart rsyslog.

Check Contents

Verify SIEM.

1. On the host server, for each of the ColdFusion instances installed, verify /etc/rsyslog.d/101-<instance name>.conf exists and contains the following contents:

module(load="imfile" PollingInterval="10")

input(type="imfile"
File="<CF install path>/<instance name>/logs/coldfusion-out.log"
Tag="coldfusion-out"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/coldfusion-error.log"
Tag="coldfusion-error"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/cfpm-audit.log"
Tag="cfpm-audit"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/audit.log"
Tag="audit"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/http.log"
Tag="http"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/mail.log"
Tag="mail"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/monitor.log"
Tag="monitor"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/server.log"
Tag="server"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/usagedata.log"
Tag="usagedata"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/update.log"
Tag="update"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/application.log"
Tag="application"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/exception.log"
Tag="exception"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/reporting.log"
Tag="reporting"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/axis2.log"
Tag="axis2"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/eventgateway.log"
Tag="eventgateway"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/license.log"
Tag="license"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/security.log"
Tag="security"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/webservice.log"
Tag="webservice"
Facility="<instance name>")

If the file contents do not monitor all logs in <CF install path>/<instance name>/logs, this is a finding.

2. Inspect /etc/rsyslog.conf or the files in /etc/rsyslog.d/.

If there is no forwarding action with type="omfwd", the rsyslog destination is not configured to send logs to a valid syslog server and this is a finding.

For additional information, refer to https://www.rsyslog.com/sending-messages-to-a-remote-syslog-server/.

Vulnerability Number

V-279070

Documentable

False

Rule Version

APAS-CF-000490

Severity Override Guidance

Verify SIEM.

1. On the host server, for each of the ColdFusion instances installed, verify /etc/rsyslog.d/101-<instance name>.conf exists and contains the following contents:

module(load="imfile" PollingInterval="10")

input(type="imfile"
File="<CF install path>/<instance name>/logs/coldfusion-out.log"
Tag="coldfusion-out"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/coldfusion-error.log"
Tag="coldfusion-error"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/cfpm-audit.log"
Tag="cfpm-audit"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/audit.log"
Tag="audit"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/http.log"
Tag="http"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/mail.log"
Tag="mail"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/monitor.log"
Tag="monitor"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/server.log"
Tag="server"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/usagedata.log"
Tag="usagedata"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/update.log"
Tag="update"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/application.log"
Tag="application"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/exception.log"
Tag="exception"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/reporting.log"
Tag="reporting"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/axis2.log"
Tag="axis2"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/eventgateway.log"
Tag="eventgateway"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/license.log"
Tag="license"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/security.log"
Tag="security"
Facility="<instance name>")

input(type="imfile"
File="<CF install path>/<instance name>/logs/webservice.log"
Tag="webservice"
Facility="<instance name>")

If the file contents do not monitor all logs in <CF install path>/<instance name>/logs, this is a finding.

2. Inspect /etc/rsyslog.conf or the files in /etc/rsyslog.d/.

If there is no forwarding action with type="omfwd", the rsyslog destination is not configured to send logs to a valid syslog server and this is a finding.

For additional information, refer to https://www.rsyslog.com/sending-messages-to-a-remote-syslog-server/.

Check Content Reference

M

Target Key

5724