From b97cb22b4c31c8c8bf9b75bfbc3289a2dec589be Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Fri, 28 Oct 2022 12:52:41 -0400 Subject: [PATCH 1/2] Update okta_mfa_exhaustion_hunt.yml --- .../experimental/application/okta_mfa_exhaustion_hunt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml index 979f462f57..3bf6da51b7 100644 --- a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml @@ -2,7 +2,7 @@ name: Okta MFA Exhaustion Hunt id: 97e2fe57-3740-402c-988a-76b64ce04b8d version: 1 date: '2022-09-27' -author: Michael Haag, Splunk +author: Michael Haag, Marissa Bower Splunk type: Hunting datamodel: [] description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed. From 0f5f0940154aea5c227f8ecefb5e7b022d9cb07c Mon Sep 17 00:00:00 2001 From: josehelps Date: Fri, 28 Oct 2022 12:57:20 -0400 Subject: [PATCH 2/2] updating --- .../experimental/application/okta_mfa_exhaustion_hunt.yml | 2 +- .../application/okta_two_or_more_rejected_okta_pushes.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml index 3bf6da51b7..383c435701 100644 --- a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml @@ -2,7 +2,7 @@ name: Okta MFA Exhaustion Hunt id: 97e2fe57-3740-402c-988a-76b64ce04b8d version: 1 date: '2022-09-27' -author: Michael Haag, Marissa Bower Splunk +author: Michael Haag, Marissa Bower, Splunk type: Hunting datamodel: [] description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed. diff --git a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml index c0d6910f42..a824d49846 100644 --- a/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml +++ b/detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml @@ -2,7 +2,7 @@ name: Okta Two or More Rejected Okta Pushes id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 version: 1 date: '2022-09-27' -author: Michael Haag, Splunk +author: Michael Haag, Marissa Bower, Splunk type: TTP datamodel: [] description: The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window.