AWS New SAML/OIDC Identity Provider Added
Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.
Cortex XDR

