Jason Symczak
10/02/2026, 4:35 PMbatch -f /var/saml_protection_v1.txtexec :add responder policy pol_samlauth_prefixlist_block "HTTP.REQ.URL.PATH.SET_TEXT_MODE(IGNORECASE).EQ(\"/cgi/samlauth\") && (HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TE XT_MODE(IGNORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").AFTER_STR(\"SAMLResponse=\").LENGTH.GT(0) || HTTP.REQ.BODY(65536).SET_TEXT_MODE(URLENCODED).SET_TEXT_MODE(IGN ORECASE).DECODE_USING_TEXT_MODE.AFTER_STR(\"SAMLResponse=\").BEFORE_STR(\"&\").B64DECODE.REGEX_MATCH(re#(?is)PrefixList.(\"([^\" ]* ){15}|\'([^\' ]* ){15})#))" DROP DROP ]RROR: No such argument [DROP Done