WebLogic Server Security
The WebLogic Server Security dashboard provides centralized visibility into WebLogic Server security, audit, and access activity over a specified time period.
Security and WebLogic administrators can use the Security tab to investigate suspicious requests, authentication failures, TLS and security errors, denied endpoints, and HTTP method activity. Use the Audit & Access tab to review authentication and authorization failures, account-lockout events, role and policy changes, configuration activity, and unusual HTTP requests; some audit widgets require the relevant WebLogic auditing features to be enabled.
Here's the list of widgets displayed in the Security tab in WebLogic Server Security dashboard:
| Widget | Description |
|---|---|
| WLS Servers | Shows the number of WebLogic Servers that reported WebLogic Server logs during the selected time range. Use it to confirm the server population contributing security data to the dashboard. |
| Suspicious Request Trend | Shows the trend of requests that match potential traversal, injection, cross-site scripting (XSS), or sensitive-path probe patterns. Use it to identify spikes that may warrant investigation. |
| Authentication Failure Burst by Client IP | Shows minute-level bursts of failed authentication attempts grouped by parsed client IP address. Use it to identify clients associated with repeated authentication failures. |
| TLS and Security Errors | Shows warning-and-higher WebLogic Server events related to TLS, SSL, certificates, and security. Use it to identify security configuration or certificate issues requiring attention. |
| Top Denied Endpoints | Shows endpoint and HTTP status-code combinations with the highest number of access-control denials. Use it to prioritize protected resources receiving repeated denied requests. |
| HTTP Method Distribution | Shows request volume by HTTP method. Use it to identify unexpected method usage and shifts in application traffic patterns. |
| Suspicious URI Patterns | Shows WebLogic access-log requests that match potential traversal, injection, cross-site scripting (XSS), or sensitive-path probe patterns. Treat these as investigation indicators rather than confirmed malicious activity. |
Here's the list of widgets displayed in the Audit & Access tab in WebLogic Server Security dashboard:
| Widget | Description |
|---|---|
| Audit Authentication Failures | Shows authentication failures recorded in WebLogic Server audit records. Requires audit logs from the DefaultAuditor provider. |
| Authorization Denials | Shows authorization audit failures, including denied requests to protected resources and configuration actions. Use it to identify access-control issues and potentially unauthorized activity. |
| Account Lockout Events | Shows user lock, unlock, and lockout-expiry events recorded by the WebLogic Server Auditing provider. Use it to investigate account-access and lockout activity. |
| Role and Policy Changes | Shows role and policy deployment or removal events recorded by WebLogic Server auditing. Use it to monitor changes that can affect user access and authorization. |
| Configuration and Admin Changes | Shows security-relevant configuration changes and management operations. Requires Configuration Auditing to be enabled on the Administration Server. |
| User and Operation Activity | Shows authenticated requests grouped by parsed user, HTTP method, and URI. Use it to investigate user activity and the operations performed through the application. |
| Rare HTTP Requests | Shows low-frequency HTTP method and URI combinations for investigation. Compare these requests with known application behavior before treating them as suspicious. |
| Authentication Failure Trend | Shows the trend of HTTP 401 and 403 responses over time. Use it to identify increases in authentication-related access failures. |