diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml index 979f462f57..383c435701 100644 --- a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml @@ -2,7 +2,7 @@ name: Okta MFA Exhaustion Hunt id: 97e2fe57-3740-402c-988a-76b64ce04b8d version: 1 date: '2022-09-27' -author: Michael Haag, Splunk +author: Michael Haag, Marissa Bower, Splunk type: Hunting datamodel: [] description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed. diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml index c0d6910f42..a824d49846 100644 --- a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml @@ -2,7 +2,7 @@ name: Okta Two or More Rejected Okta Pushes id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 version: 1 date: '2022-09-27' -author: Michael Haag, Splunk +author: Michael Haag, Marissa Bower, Splunk type: TTP datamodel: [] description: The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window.