From 48fc2a4c33d92aee6acfe8cfdcd8ffadb67d66f4 Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Fri, 2 Dec 2022 13:09:47 -0600 Subject: [PATCH] Added tuning search for Abnormally High Number Of Okta MFA Attempts --- baselines/tuning_okta_mfa_attempts.yml | 55 +++++++++++++++++++ deployments/33_run_weekly_30_day_lookback.yml | 14 +++++ 2 files changed, 69 insertions(+) create mode 100644 baselines/tuning_okta_mfa_attempts.yml create mode 100644 deployments/33_run_weekly_30_day_lookback.yml diff --git a/baselines/tuning_okta_mfa_attempts.yml b/baselines/tuning_okta_mfa_attempts.yml new file mode 100644 index 0000000000..06b97754e1 --- /dev/null +++ b/baselines/tuning_okta_mfa_attempts.yml @@ -0,0 +1,55 @@ +name: Baseline Of OKTA MFA Attempts +id: 5f5c1aa4-3548-4533-be7a-3f1a60eef43f +version: 1 +date: '2022-12-02' +author: David Dorsey, Splunk +type: Baseline +datamodel: [] +description: 'This search is designed to find users that fire the detection + "Large Amount Of Okta MFA Attempts - MLTK" enough times that it does not make sense + for the alert to be applied to that user. It will then populate the lookup file used by + the detection with all users that should be filtered out. +search: '`okta` eventType=user.authentication.auth_via_mfa | bin span=10m _time + | stats count as mfa_attempts by src_user, _time + | apply escu_okta_mfa_attempts_v1 upper_threshold=0.001 + | rename IsOutlier(mfa_attempts) as outlier | where outlier=1 + | eventstats count as total + | stats count, max(total) as total by src_user + | eval percent = count/total + | where (percent >= 0.10 and total >= 300) or (percent >= 0.30 and total >= 100) + | fields src_user + | eval ignore = 1 + | outputlookup ignore_list_okta_mfa_attempts' + +how_to_implement: 'You must run the search "Baseline Of OKTA MFA Attempts" before this search.' +known_false_positives: none +references: + - https://developer.okta.com/docs/reference/api/event-types/?q=app.generic.unauth_app_access_attempt +tags: + analytic_story: + - Suspicious Okta Activity + - Suspicious Cloud Instance Activities + asset_type: Infrastructure + deployments: + - Weekly Run 30 Day Lookback + cis20: + - CIS 16 + mitre_attack_id: + - T1078 + - T1078.001 + nist: + - DE.CM + kill_chain_phases: + - Exploitation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + detections: + - Abnormally High Number Of Okta MFA Attempts + required_fields: + - _time + - src_user + - event_type + security_domain: access + diff --git a/deployments/33_run_weekly_30_day_lookback.yml b/deployments/33_run_weekly_30_day_lookback.yml new file mode 100644 index 0000000000..a455c9f57f --- /dev/null +++ b/deployments/33_run_weekly_30_day_lookback.yml @@ -0,0 +1,14 @@ +name: Weekly Run 30 Day Lookback +id: 527c6836-897f-4b86-97a3-349113a07e3b +date: '2022-12-02' +author: David Dorsey +description: This configuration file executes searches weekly and looking back over 30 days + Weekly Run 30 Day Lookback +scheduling: + cron_schedule: 0 1 * * 0 + earliest_time: -31d@d + latest_time: -1d@d + schedule_window: auto +tags: + deployments: + - Weekly Run 30 Day Lookback