SSO
any: SSO (catch-all)
#Description
Matches any sso event.
Fields #
| Name | Description | Rules |
|---|---|---|
uuid | Unique event identifier. | |
timestamp | Time the event occurred. | |
actor_uuid | Actor identifier. | |
actor_details.uuid | Actor identifier. | |
actor_details.name | Actor's full name. | |
actor_details.email | Actor's email address. | |
actor_type | Type of actor. | |
actor_account_uuid | 1Password account identifier of the actor. | |
account_uuid | 1Password account identifier. | |
action | Action performed. | 1 detection rule |
object_type | Type of affected object. | 1 detection rule |
object_uuid | Identifier of the affected object. | |
object_details.uuid | Affected user identifier, when applicable. | |
object_details.name | Affected user's full name, when applicable. | |
object_details.email | Affected user's email address, when applicable. | |
aux_id | Numeric identifier for related event data. | |
aux_uuid | Identifier for related event data. | |
aux_details.uuid | Related user identifier, when applicable. | |
aux_details.name | Related user's full name, when applicable. | |
aux_details.email | Related user's email address, when applicable. | |
aux_info | Additional event information. | |
session.uuid | Session identifier. | |
session.login_time | Time the session started. | |
session.device_uuid | Identifier of the session device. | |
session.ip | IP address used for the session. | |
location.country | Client country inferred from IP address. | |
location.region | Client region inferred from IP address. | |
location.city | Client city inferred from IP address. | |
location.longitude | Client longitude inferred from IP address. | |
location.latitude | Client latitude inferred from IP address. |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
log_source (kusto rule field) | eq | auditevents | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1556
sso-addgsso: Add an SSO Group.
#Description
An SSO group was added.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngasso: Change SSO Grace Period Authentication Count
#Description
The SSO grace period authentication count was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngdsso: Change SSO Grace Period Duration
#Description
The SSO grace period duration was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngpsso: Change SSO Authentication Policy
#Description
The SSO authentication policy was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-delgsso: Delete an SSO Group.
#Description
An SSO group was deleted.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-disblsso: Disable SSO
#Description
Unlock with SSO was disabled.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-enblsso: Enable SSO
#Description
Unlock with SSO was enabled.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |