admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

removed the tuning logic from SPL since it's in the macro

Browse Source
This commit is contained in:
David Dorsey
2022-12-02 14:33:00 -06:00
parent a82aa14b55
commit 7ccbcbdd31
1 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/okta_large_mfa_attempts.yml
-2
View File
@@ -10,8 +10,6 @@ description: The following analytic identifies an account that has rejected more
search: '`okta` eventType=user.authentication.auth_via_mfa | bin span=10m _time
| stats count as mfa_attempts by src_user, _time | eventstats avg(mfa_attempts) as average_attempts
| apply escu_okta_mfa_attempts_v1 upper_threshold=0.001 | rename IsOutlier(mfa_attempts) as outlier | where outlier=1
| lookup ignore_list_okta_mfa_attempts src_user as src_user outputnew ignore
| where isnull(ignore)
| eval upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
| `security_content_ctime(_time)`
| table _time, src_user, mfa_attempts, average_attempts, upper_threshold