STIGQter STIGQter: STIG Summary: Oracle WebLogic Server 12c Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 26 Jul 2019: Oracle WebLogic must produce process events and security levels to establish what type of Oracle WebLogic process events and severity levels occurred.

DISA Rule

SV-70491r1_rule

Vulnerability Number

V-56237

Group Title

SRG-APP-000095-AS-000058

Rule Version

WBLC-02-000075

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. From the list of servers, select one which needs AS process logging configured
4. Utilize 'Change Center' to create a new change session
5. From 'Logging' tab -> 'General' tab, set the 'Log file name' field to 'logs/<server-name>.log
6. Click 'Save', and from 'Change Center' click 'Activate Changes' to enable configuration changes

Check Contents

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Logs' -> 'View Log Messages'
3. Within the 'Search' panel, expand 'Selected Targets'
4. Click 'Target Log Files' icon for 'AdminServer' target
5. From the list of log files, select '<server-name>.log' and click 'View Log File' button
6. All AS process logging of the AdminServer will be displayed
7. Repeat for each managed server

If the managed servers or AdminServer does not have process events, this is a finding.

Vulnerability Number

V-56237

Documentable

False

Rule Version

WBLC-02-000075

Severity Override Guidance

1. Access EM
2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Logs' -> 'View Log Messages'
3. Within the 'Search' panel, expand 'Selected Targets'
4. Click 'Target Log Files' icon for 'AdminServer' target
5. From the list of log files, select '<server-name>.log' and click 'View Log File' button
6. All AS process logging of the AdminServer will be displayed
7. Repeat for each managed server

If the managed servers or AdminServer does not have process events, this is a finding.

Check Content Reference

M

Target Key

2545

Comments