Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
You do not specify what version of Jboss you are referring to, or if you're talking about EAP from Redhat, or the Community Edition.
The configuration is quite different from for instance Jboss CE 6 to 7.
These are some starting resources for both EAP and CE: