IBM Security Access Manager Redirect Pattern Anomaly
Detects unusual volumes of redirects through WebSEAL. Open or manipulable redirects on an authentication gateway are valuable to an attacker: a link that genuinely begins on the organisation's own trusted domain will survive scrutiny that an external link would not. Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED' | duration 1h | groupby srcip, url, uriquery, returncode
Sigma
