admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2629 from splunk/bugfix_2623

Browse Source 
Removing extra characters around field name
This commit is contained in:
Michael Haag
2023-04-17 14:10:54 -06:00
committed by GitHub
parent bfd03a449c 50f7e69d8f
commit 03041105aa
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/okta_risk_threshold_exceeded.yml
+1 -1
View File
@@ -22,7 +22,7 @@ search:
dc(source) as source_count from datamodel=Risk.All_Risk by All_Risk.risk_object,All_Risk.risk_object_type
All_Risk.analyticstories | `drop_dm_object_name("All_Risk")` | eval "annotations.mitre_attack"="annotations.mitre_attack.mitre_technique_id",
risk_threshold=100 | where All_Risk.analyticstories IN ("Suspicious Okta Activity",
"Okta MFA Exhaustion") risk_score > $risk_threshold$ | `get_risk_severity(risk_score)`
"Okta MFA Exhaustion") risk_score > risk_threshold | `get_risk_severity(risk_score)`
| `okta_risk_threshold_exceeded_filter`'
how_to_implement:
Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic