IBM Guardium Privileged Database User Created
Detects creation of a database user observed by Guardium. Database-level accounts frequently sit outside enterprise identity governance, which makes them attractive persistence: an account created directly in the database survives directory cleanup and is rarely reviewed. Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED' | groupby user, targetuser, role, srcip
Sigma
