SAML

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'saml' without specifying an eventName attribute here.	N	N
login_success	A SAML-based single sign-on login succeeded.	N	Y
login_failure	A SAML-based single sign-on login failed.	N	Y

any: SAML (any event)

Source-only rules that filter on applicationName 'saml' without specifying an eventName attribute here.

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Esql.distance_km` (elastic rule field)	ge	`500`	1 rule	elastic
`Esql.region_count` (elastic rule field)	ge	`2`	1 rule	elastic
`Esql.region_count` (elastic rule field)	le	`5`	1 rule	elastic
`Esql.travel_kmh` (elastic rule field)	ge	`800`	1 rule	elastic
`source.geo.country_name` (elastic rule field)	is_not_null		1 rule	elastic
`source.geo.location` (elastic rule field)	is_not_null		1 rule	elastic
`source.geo.region_name` (elastic rule field)	is_not_null		1 rule	elastic
`user.email` (elastic rule field)	is_not_null		1 rule	elastic

Google Workspace Impossible Travel Login source high: Detects successful Google Workspace sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user.T1078, T1078.004, T1528, T1557