admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2022-10-28 09:59:37 -07:00
committed by GitHub
parent 9888e592be e05a76ef1f
commit db9bcbf45d
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/okta_mfa_exhaustion_hunt.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Okta MFA Exhaustion Hunt
id: 97e2fe57-3740-402c-988a-76b64ce04b8d
version: 1
date: '2022-09-27'
author: Michael Haag, Splunk
author: Michael Haag, Marissa Bower, Splunk
type: Hunting
datamodel: []
description: The following analytic identifies patterns within Okta data to determine the amount of successful and failed pushes. Based on that, eval statements determine a finding of whether this is suspicious or not. The events are within a window of time and may be tuned as needed.
detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Okta Two or More Rejected Okta Pushes
id: d93f785e-4c2c-4262-b8c7-12b77a13fd39
version: 1
date: '2022-09-27'
author: Michael Haag, Splunk
author: Michael Haag, Marissa Bower, Splunk
type: TTP
datamodel: []
description: The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window.