Detection rules › By event

AWS-sso

Event	Rules
AssociateDirectory	1
DisassociateDirectory	1
ListApplications	1
Authenticate	1
CreateToken	1

AssociateDirectory

1 detection rules reference this event. View event page.

Sigma (1)

AWS Identity Center Identity Provider Change severity high T1556

DisassociateDirectory

1 detection rules reference this event. View event page.

Sigma (1)

AWS Identity Center Identity Provider Change severity high T1556

ListApplications

1 detection rules reference this event. View event page.

Panther (1)

SIGNAL - Sign-in with AWS CLI prompt severity informational

Authenticate

1 detection rules reference this event. View event page.

Panther (1)

SIGNAL - AWS Console SSO Sign-In severity informational

CreateToken

1 detection rules reference this event. View event page.

Panther (1)

SIGNAL - Retrieve SSO access token severity informational