identity:saas
Identity providers and SaaS
Okta, GitHub and other SaaS audit logs.
- Host type
- Identity providers and SaaS (Okta, GitHub, Slack, ...)
- Minimum events
- 1
- Recommended events
- 34
- Log sources
- 4
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| GitHub audit log | Minimum | 2 | 68 |
| Okta System Log | Minimum | 18 | 114 |
| SaaS application audit logs (Slack, Salesforce, Box, Zoom, Confluence, Snowflake, ...) | Minimum | 36 | 97 |
Minimum
1 events meet the minimum bar for this role: an ATT&CK analytic names each one, and either a standard in the role's scope requires it or at least the platform's threshold of vendor rules depends on it. Grouped by log source; the source heading carries the cost class.
Okta System Log1 event · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| user.session.start | 1 | Elastic 9, Microsoft Sentinel 5 |
Recommended
34 more events meet one of the three criteria. Each source opens on its own.
GitHub audit log5 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| git.clone | 0 | Elastic 3 | ||
| oauth.authorize | 1 | none | ||
| repo.clone | 1 | none | ||
| repo.download | 1 | none | ||
| repo.getContent | 1 | none |
Okta System Log10 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| app.oauth.grant | 1 | none | ||
| MFAChallengeIssued | 1 | none | ||
| session.impersonation.start | 1 | none | ||
| session.token.reuse | 1 | none | ||
| user.authentication.auth_via_mfa | 0 | Elastic 1, Microsoft Sentinel 2 | ||
| user.authentication.sso | 2 | Elastic 2 | ||
| user.lifecycle.deactivate | 1 | none | ||
| user.lifecycle.delete.completed | 1 | none | ||
| user.lifecycle.delete.initiated | 1 | none | ||
| user.lifecycle.suspend | 1 | none |
SaaS application audit logs (Slack, Salesforce, Box, Zoom, Confluence, Snowflake, ...)19 events · Paid service
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| access.content | 2 | none | ||
| AdminAction | 1 | none | ||
| APIKeyUse | 1 | none | ||
| audit_logs | 1 | none | ||
| collaboration.invite | 1 | none | ||
| conversations.history | 1 | none | ||
| DataExport | 1 | none | ||
| file_upload | 1 | none | ||
| files.list | 1 | none | ||
| Login | 2 | none | ||
| login_failure | 1 | none | ||
| LoginSuccess | 1 | none | ||
| logon | 1 | none | ||
| message_click | 1 | none | ||
| message_send | 1 | none | ||
| ReportExport | 1 | none | ||
| RestAPI | 1 | none | ||
| signin_failed | 1 | none | ||
| users.info | 1 | none |