API

GitHub SAML/OIDC has been disabled

Docs > Datadog Security > OOTB Rules > GitHub SAML/OIDC has been disabled

Classification:

attack

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when GitHub OIDC/SAML single sign-on (SSO) has been modified.

Strategy

This rule monitors GitHub audit logs for when OIDC/SAML SSO has been modified. GitHub allows for use of a SSO solution to increase security and centralize identity and access for the web application that your team uses. Disabling these settings could lead to a degradation in the organization’s security posture.

Triage and response

Determine if the change taken by {{@github.actor}} is authorized.
If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.