DeleteSAMLProvider AWS

[saakovv]

Summary of the Pull Request

Monitoring DeleteSAMLProvider events separately from UpdateSAMLProvider makes sense, since these actions have different contexts, risks, and consequences. Tracking both types of events allows you to more fully control changes in the configuration of SAML providers and respond faster to potential threats.

Changelog

Example Log Event

{ [-]
   awsCloud_account_ID: 123
   awsRegion: us-east
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 123
   eventName: DeleteSAMLProvider
   eventSource: iam.amazonaws.com
   eventTime: 2024-09-12T07:53:45Z
   eventType: AwsApiCall
   eventVersion: 1.09
   managementEvent: true
   readOnly: false
   recipientAccountId: 123
   requestID: 123
   requestParameters: { [+]
   }
   responseElements: null
   sourceIPAddress: XXXX
    tlsDetails: { [+]
   }
   userAgent: Boto3/1.26.32 
   userIdentity: { [-]
     accessKeyId: 123
     accountId: 123
     arn: arn:aws:iam::123
     principalId:123
     type: IAMUser
     userName: test-connect
   }
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @saakovv 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃