Google Analytics must be disabled in EAP Console.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62263	JBOS-AS-000225	SV-76753r1_rule		Medium

Description
The Google Analytics feature aims to help Red Hat EAP team understand how customers are using the console and which parts of the console matter the most to the customers. This information will, in turn, help the team to adapt the console design, features, and content to the immediate needs of the customers. Sending analytical data to the vendor introduces risk of unauthorized data exfiltration. This capability must be disabled.

Description

The Google Analytics feature aims to help Red Hat EAP team understand how customers are using the console and which parts of the console matter the most to the customers. This information will, in turn, help the team to adapt the console design, features, and content to the immediate needs of the customers. Sending analytical data to the vendor introduces risk of unauthorized data exfiltration. This capability must be disabled.

STIG	Date
JBoss EAP 6.3 Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-63067r1_chk )
Open the EAP web console by pointing a web browser to HTTPS://:9443 or HTTP://:9990 Log on to the admin console using admin credentials. On the bottom right-hand side of the screen, select "Settings". If the "Enable Data Usage Collection" box is checked, this is a finding.

Fix Text (F-68183r1_fix)
Using the EAP web console, log on using admin credentials. On the bottom right-hand side of the screen, select "Settings", uncheck the "Enable Data Usage Collection" box, and save the configuration.