From b97cb22b4c31c8c8bf9b75bfbc3289a2dec589be Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Fri, 28 Oct 2022 12:52:41 -0400 Subject: [PATCH] Update okta_mfa_exhaustion_hunt.yml --- .../experimental/application/okta_mfa_exhaustion_hunt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml index 979f462f57..3bf6da51b7 100644 --- a/detections/experimental/application/okta_mfa_exhaustion_hunt.yml +++ b/detections/experimental/application/okta_mfa_exhaustion_hunt.yml @@ -2,7 +2,7 @@ name: Okta MFA Exhaustion Hunt id: 97e2fe57-3740-402c-988a-76b64ce04b8d version: 1 date: '2022-09-27' -author: Michael Haag, Splunk +author: Michael Haag, Marissa Bower Splunk type: Hunting datamodel: [] description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed.