Push Security

Search Push Security rules.

Telemetry Evidence

These values show how indexed rules identify Push Security telemetry.

Panther

Log type PushSecurity.Activity (3 rules)
Log type PushSecurity.Controls (1 rule)
Log type PushSecurity.Entities (5 rules)
Platform pushsecurity (9 rules)

Detection Rules

Panther #

Push Security App Banner Acknowledged source low
Push Security Authorized IdP Login source informational: Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.
Push Security New App Detected source informational
Push Security New SaaS Account Created source informational
Push Security Open Security Finding source informational
Push Security Phishable MFA Method source informational
Push Security Phishing Attack source high
Push Security SaaS App MFA Method Changed source informational: MFA method on SaaS app changed
Push Security Unauthorized IdP Login source high: Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.