SSO

any: SSO (catch-all)

#

Description

Matches any sso event.

Fields #

NameDescriptionRules
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.1 detection rule
object_typeType of affected object.1 detection rule
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
log_source (kusto rule field)eqauditevents1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

sso-addgsso: Add an SSO Group.

#

Description

An SSO group was added.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-chngasso: Change SSO Grace Period Authentication Count

#

Description

The SSO grace period authentication count was changed.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-chngdsso: Change SSO Grace Period Duration

#

Description

The SSO grace period duration was changed.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-chngpsso: Change SSO Authentication Policy

#

Description

The SSO authentication policy was changed.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-delgsso: Delete an SSO Group.

#

Description

An SSO group was deleted.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-disblsso: Disable SSO

#

Description

Unlock with SSO was disabled.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

sso-enblsso: Enable SSO

#

Description

Unlock with SSO was enabled.

Fields #

NameDescription
uuidUnique event identifier.
timestampTime the event occurred.
actor_uuidActor identifier.
actor_details.uuidActor identifier.
actor_details.nameActor's full name.
actor_details.emailActor's email address.
actor_typeType of actor.
actor_account_uuid1Password account identifier of the actor.
account_uuid1Password account identifier.
actionAction performed.
object_typeType of affected object.
object_uuidIdentifier of the affected object.
object_details.uuidAffected user identifier, when applicable.
object_details.nameAffected user's full name, when applicable.
object_details.emailAffected user's email address, when applicable.
aux_idNumeric identifier for related event data.
aux_uuidIdentifier for related event data.
aux_details.uuidRelated user identifier, when applicable.
aux_details.nameRelated user's full name, when applicable.
aux_details.emailRelated user's email address, when applicable.
aux_infoAdditional event information.
session.uuidSession identifier.
session.login_timeTime the session started.
session.device_uuidIdentifier of the session device.
session.ipIP address used for the session.
location.countryClient country inferred from IP address.
location.regionClient region inferred from IP address.
location.cityClient city inferred from IP address.
location.longitudeClient longitude inferred from IP address.
location.latitudeClient latitude inferred from IP address.

References #