V-279070

Discussion

ColdFusion must be capable of integrating with a third-party SIEM solution to provide centralized log collection, event correlation, and real-time alerting. Without integration into a SIEM, audit records generated by ColdFusion may remain isolated on the local system, limiting visibility and hindering the ability of security personnel to detect, investigate, and respond to suspicious activity or system misconfigurations. Timely notifications of security-relevant events are critical for incident response and continuous monitoring. If ColdFusion is not configured to transmit these logs or events to an external monitoring platform, malicious activity may go undetected until after significant damage has occurred. SIEM integration also supports compliance with audit and accountability requirements by ensuring audit data is retained in a secure, tamper-evident location outside the local ColdFusion instance. In the event of system compromise, this external logging provides a reliable forensic trail and helps validate system integrity. Satisfies: SRG-APP-000231-AS-000156, SRG-APP-000108-AS-000067, SRG-APP-000125-AS-000084, SRG-APP-000126-AS-000085, SRG-APP-000181-AS-000255, SRG-APP-000290-AS-000174, SRG-APP-000358-AS-000064, SRG-APP-000360-AS-000066, SRG-APP-000515-AS-000203, SRG-APP-000795-AS-000130

Check Content

Verify SIEM.

1. On the host server, for each of the ColdFusion instances installed, verify /etc/rsyslog.d/101-<instance name>.conf exists and contains the following contents: 

module(load="imfile" PollingInterval="10") 

input(type="imfile"
      File="<CF install path>/<instance name>/logs/coldfusion-out.log"
      Tag="coldfusion-out"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/coldfusion-error.log"
      Tag="coldfusion-error"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/cfpm-audit.log"
      Tag="cfpm-audit"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/audit.log"
      Tag="audit"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/http.log"
      Tag="http"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/mail.log"
      Tag="mail"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/monitor.log"
      Tag="monitor"
      Facility="<instance name>")

input(type="imfile"
      File="<CF install path>/<instance name>/logs/server.log"
      Tag="server"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/usagedata.log"
      Tag="usagedata"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/update.log"
      Tag="update"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/application.log"
      Tag="application"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/exception.log"
      Tag="exception"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/reporting.log"
      Tag="reporting"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/axis2.log"
      Tag="axis2"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/eventgateway.log"
      Tag="eventgateway"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/license.log"
      Tag="license"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/security.log"
      Tag="security"
      Facility="<instance name>")
  
input(type="imfile"
      File="<CF install path>/<instance name>/logs/webservice.log"
      Tag="webservice"
      Facility="<instance name>")   

If the file contents do not monitor all logs in <CF install path>/<instance name>/logs, this is a finding. 

2. Inspect /etc/rsyslog.conf or the files in /etc/rsyslog.d/.

If there is no forwarding action with type="omfwd", the rsyslog destination is not configured to send logs to a valid syslog server and this is a finding.

For additional information, refer to https://www.rsyslog.com/sending-messages-to-a-remote-syslog-server/.