IBM Security Access Manager Suspicious Request URI

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects requests through WebSEAL whose URI or query string carries exploitation characteristics. As a reverse proxy, WebSEAL sees the full request before it reaches the application, which makes it the right place to catch attempts against back-end systems that log very little themselves. Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webserver where sourcename='ISAM-WEBSEAL' | groupby url, uriquery, method, returncode, srcip, useragent