DeleteSAMLProvider AWS

[saakovv]

Summary of the Pull Request

Monitoring DeleteSAMLProvider events separately from UpdateSAMLProvider makes sense, since these actions have different contexts, risks, and consequences. Tracking both types of events allows you to more fully control changes in the configuration of SAML providers and respond faster to potential threats.

Changelog

Example Log Event

{ [-]
   awsCloud_account_ID: XXXX
   awsRegion: us-east-1
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 6b09429c
   eventName: DeleteSAMLProvider
   status:success
   eventSource: iam.amazonaws.com
   eventTime: 2024-09-12T07:53:45Z
   eventType: AwsApiCall
   eventVersion: 1.09
   managementEvent: true
   readOnly: false
   recipientAccountId: XXXX
   requestID: f082cd90
   requestParameters: { [-]
     sAMLProviderArn: arn:aws:iam::XXXX:saml-provider/AWSSSO_XXXX_DO_NOT_DELETE
   }
   responseElements: null
   sourceIPAddress: XXXX
   tlsDetails: { [-]
     cipherSuite: TLS_AES_128_GCM_SHA256
     clientProvidedHostHeader: iam.amazonaws.com
     tlsVersion: TLSv1.3
   }
   userAgent: Boto3/1.26.32 Python/3.10.14 Darwin/23.6.0 Botocore/1.29.32
   userIdentity: { [-]
     accessKeyId: XXXX
     accountId: XXXX
     arn: arn:aws:iam::XXXX:user/XXXX
     principalId: XXXX
     type: IAMUser
     userName: XXXX
   }
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @saakovv 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃