IBM Security Access Manager Authentication Failure Burst

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects repeated authentication failures at the IBM Security Access Manager reverse proxy. WebSEAL fronts internal applications for external users, so it is the first thing an attacker reaches and frequently the only control between the internet and a legacy application that has none of its own. Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=authentication where sourcename='ISAM-WEBSEAL' and action='LOGIN' | duration 15m | groupby srcip, status, reason | select srcip, status, reason, distinct_count(user) | having distinct_count_col1 > 8