Detection · sessions
A session that did not come from the identity provider.
Written next to the SonicWall SAML note, and meant to outlive it. The signal is a login method that policy already forbade.
The comparison
When a tenant has decided that SSO is mandatory, a finished login that never touched the identity provider is the event. The bug that gets the login accepted will change. The mismatch will not: policy said SAML, the session record says something else.
Keep four fields. Account. Time. Authentication method. Source address. If the VPN log and the identity provider disagree on the method, you do not need the CVE number to open a ticket. You need the account owner.
Baseline before the catalog date
Start at least two weeks before the KEV addition, not the morning you patch. A side door used every day since March is a configuration you have been calling SSO. A side door that appears in the week of 6 November is closer to the SonicWall class. Both are work. They are not the same work, and a single alert with no baseline will page you for the break-glass account finance uses on purpose.
Exclude the break-glass accounts in the rule text, by name, with an owner. An exclusion of "administrator" is how the side door stays quiet.
What not to ship as a detection
- A hash of a portal page. It changes when the vendor changes a stylesheet, and it says nothing about which method succeeded.
- A string copied from a public exploit. It detects people who pasted that exploit, until they stop pasting it.
- A count of failed logins. This class succeeds. Failure dashboards stay green.
After the patch
Leave the comparison in place. The firmware build closes one implementation. The next appliance in the fleet still has a local user named the same as the contractor who left in June. The detection is the policy check. The CVE is only this month's reason to turn it on.