You can mention the session-timeout in the web.xml file of your application. However, if you want to change at a global level for all applications deployed on JBoss, then you will have to change it in the web.xml file present under %JBOSS_HOME%/server/<servername>/deploy/jbossweb-tomcatxx.sar/conf folder. It has the following:
<!-- ==================== Default Session Configuration ================= -->
<!-- You can set the default session timeout (in minutes) for all newly -->
<!-- created sessions by modifying the value below. -->
<session-config>
<session-timeout>30</session-timeout>
</session-config>