STIGQter: STIG Summary: IBM WebSphere Traditional V9.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Aug 2018:

The WebSphere Application Server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.

DISA Rule

SV-95959r1_rule

Vulnerability Number

V-81245

Group Title

SRG-APP-000108-AS-000067

Rule Version

WBSP-AS-000640

Severity

CAT III

CCI(s)

• CCI-000139 - The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.

Weight

10

Fix Recommendation

Establish and utilize a notification process for WebSphere log events or configure WebSphere to send log event alerts via email.

In the administrative console, navigate to Security >> Security auditing >> Audit monitor.

Click on "New" button.

Specify a unique name for the new notification name.

Click "Message log" checkbox.

Select "Email sent to notification list".

Enter SA and ISSO emails in the "Email address to add" field.

Enter the mail server address in the "Outgoing mail (STMP) server" field.

Click ">" to put email in "List of email addresses" field.

Click "OK".

Select the "Enable monitoring" check box to turn on audit failure notifications.

Select the notification configuration to be used from the "Monitor notification" dropdown menu.

Click "OK".

Click "Save".

Check Contents

If the SA and ISSO are notified of log processing failures via an alternative notification process, this is not a finding.

In the administrative console, navigate to Security >> Security auditing >> Audit monitor.

If "Enabled monitoring" is not checked and "Monitor notification" is not set to a notification in the notifications list, that includes the SA and ISSO, this is a finding.

Vulnerability Number

V-81245

Documentable

False

Rule Version

WBSP-AS-000640

Severity Override Guidance

If the SA and ISSO are notified of log processing failures via an alternative notification process, this is not a finding.

In the administrative console, navigate to Security >> Security auditing >> Audit monitor.

If "Enabled monitoring" is not checked and "Monitor notification" is not set to a notification in the notifications list, that includes the SA and ISSO, this is a finding.

Check Content Reference

M

Target Key

3399

Comments