STIGQter: STIG Summary: Omnissa WS1 UEM Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 May 2026:

The Omnissa WS1 UEM server must be configured to transfer Omnissa WS1 UEM server logs to another server for storage, analysis, and reporting. Note: Omnissa WS1 UEM server logs include logs of UEM events and logs transferred to the Omnissa WS1 UEM server by UEM agents of managed devices.

DISA Rule

SV-284305r1224048_rule

Vulnerability Number

V-284305

Group Title

SRG-APP-000358-UEM-000228

Rule Version

OMW1-00-006500

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
• CCI-001294 - Alert organization-defined personnel or roles of failed security verification tests.
• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

Configure the Workspace ONE UEM server to transfer Workspace ONE UEM server logs to another server for storage, analysis, and reporting.

On the MDM console, do the following:

1. Authenticate to the Workspace ONE UEM console as the administrator.
2. Navigate to Groups & Settings >> All Settings >> System >> Enterprise Integration >> Syslog.
3. Set "Syslog Integration" to "ENABLED".
4. Configure syslog server hostname, protocol, port, syslog facility, message tag, message content according to organizational standards.
5. Click "SAVE".
6. Verify changes save successfully and Workspace ONE UEM server can transfer audit logs to the new syslog server.

Check Contents

Review the Workspace ONE UEM server configuration settings and verify the server is configured to transfer Workspace ONE UEM server logs to another server for storage, analysis, and reporting.

On the MDM console, do the following:

1. Authenticate to the Workspace ONE UEM console as the administrator.
2. Navigate to Groups & Settings >> All Settings >> System >> Enterprise Integration >> Syslog.
3. If "Syslog Integration" is set to "DISABLED", this is a finding.
4. Examine the syslog configuration (server hostname, protocol, port, syslog facility, message tag, message content) for conformance with operational standards.

If any are not set according to the standards, this is a finding.

Note: Workspace ONE UEM server logs include logs of MDM events and logs transferred to the Workspace ONE UEM server by MDM agents of managed devices.

Vulnerability Number

V-284305

Documentable

False

Rule Version

OMW1-00-006500

Severity Override Guidance

Review the Workspace ONE UEM server configuration settings and verify the server is configured to transfer Workspace ONE UEM server logs to another server for storage, analysis, and reporting.

On the MDM console, do the following:

1. Authenticate to the Workspace ONE UEM console as the administrator.
2. Navigate to Groups & Settings >> All Settings >> System >> Enterprise Integration >> Syslog.
3. If "Syslog Integration" is set to "DISABLED", this is a finding.
4. Examine the syslog configuration (server hostname, protocol, port, syslog facility, message tag, message content) for conformance with operational standards.

If any are not set according to the standards, this is a finding.

Note: Workspace ONE UEM server logs include logs of MDM events and logs transferred to the Workspace ONE UEM server by MDM agents of managed devices.

Check Content Reference

M

Target Key

5751