SAML
| eventName | Description | Sample | Rule |
|---|---|---|---|
| login_ | A SAML-based single sign-on login succeeded. | N | Y |
| login_ | A SAML-based single sign-on login failed. | N | Y |
login_success: SAML Login Success
#Description
A SAML-based single sign-on login succeeded.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
event.action | 1 detection rule | Elastic |
event.outcome | 1 detection rule | Elastic |
source.geo.country_name | 1 detection rule | Elastic |
source.geo.location | 1 detection rule | Elastic |
source.geo.region_name | 1 detection rule | Elastic |
user.email | 1 detection rule | Elastic |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Esql.distance_km (elastic rule field) | ge | 500 | 1 rule | elastic |
Esql.region_count (elastic rule field) | ge | 2 | 1 rule | elastic |
Esql.region_count (elastic rule field) | le | 5 | 1 rule | elastic |
Esql.travel_kmh (elastic rule field) | ge | 800 | 1 rule | elastic |
source.geo.country_name (elastic rule field) | is_not_null | | 1 rule | elastic |
source.geo.location (elastic rule field) | is_not_null | | 1 rule | elastic |
source.geo.region_name (elastic rule field) | is_not_null | | 1 rule | elastic |
user.email (elastic rule field) | is_not_null | | 1 rule | elastic |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Elastic #
T1078, T1078.004, T1528, T1557
References #
login_failure: SAML Login Failure
#Description
A SAML-based single sign-on login failed.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
EventMessage | 1 detection rule | Kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
T1110
References #
any: SAML (any event)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Source-only rules that filter on applicationName 'saml' without specifying an eventName attribute here.