IBM Security Access Manager Repeated Request Denials

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate requests for resources the identity is not entitled to reach, and a pattern of them is enumeration of the protected application estate from a position already inside the authentication boundary. Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED' | duration 1h | groupby srcip, user | select srcip, user, distinct_count(url) | having distinct_count_col1 > 15