admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-02-18 16:54:40 +00:00
committed by GitHub
parent 1c545661f2 ee47910bf9
commit 1afdf89e99
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
+3 -3
View File
@@ -1,4 +1,4 @@
name: Multiple Okta Users With Invalid Credentails From The Same IP
name: Multiple Okta Users With Invalid Credentials From The Same IP
id: 19cba45f-cad3-4032-8911-0c09e0444552
version: 2
date: '2020-07-21'
@@ -12,12 +12,12 @@ search: '`okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalC
as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users
values(user) as users by src_ip, displayMessage, outcome.reason, country, state,
city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| search distinct_users > 5| `multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter` '
| search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` '
how_to_implement: This search is specific to Okta and requires Okta logs are being
ingested in your Splunk deployment.
known_false_positives: A single public IP address servicing multiple legitmate users
may trigger this search. In addition, the threshold of 5 distinct users may be too
low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise
low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise
the threshold or except specific IP adresses from triggering this search.
references: []
tags: