GitHub SAML/OIDC has been disabled

문서 > Datadog 보안 > OOTB Rules > GitHub SAML/OIDC has been disabled

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when GitHub OIDC/SAML single sign-on (SSO) has been modified.

Strategy

This rule monitors GitHub audit logs for when OIDC/SAML SSO has been modified. GitHub allows for use of a SSO solution to increase security and centralize identity and access for the web application that your team uses. Disabling these settings could lead to a degradation in the organization’s security posture.

Triage and response

Determine if the change taken by {{@github.actor}} is authorized.
If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.