admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update okta_two_or_more_rejected_okta_pushes.yml

Browse Source
This commit is contained in:
Michael Haag
2022-09-27 15:15:11 -06:00
parent 7208e0198a
commit ddcbfa65d0
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/okta_two_or_more_rejected_okta_pushes.yml
+1 -1
View File
@@ -9,7 +9,7 @@ description: The following analytic identifies an account that has rejected more
Modify this query for your environment by upping the count or time window.
search: '`okta` outcome.reason="User rejected Okta push verify" OR (debugContext.debugData.factor="OKTA_VERIFY_PUSH" outcome.result=FAILURE legacyEventType="core.user.factor.attempt_fail" "target{}.detailEntry.methodTypeUsed"="Get a push notification")
| bin _time as bin_time span=10m
| eval user=coalesce("actor.alternateId",user), user=mvindex(split(user, "@"), 0), event_time = _time
| eval user=coalesce(actor.alternateId,user), user=mvindex(split(user, "@"), 0), event_time = _time
| stats earliest(event_time) as event_time, min(_time) as firsttime max(_time) as lasttime values(client.ipAddress) as client.ipAddress, values(outcome.reason) as outcome, values(src_ip) AS src_ip, values(client.userAgent.rawUserAgent) as user_agent, values(eventType) as eventType, values(outcome.result) as action, values(legacyEventType) as legacyEventType values(index) as idx, values(sourcetype) as st count by bin_time user host
| rename bin_time as timeWindow
| convert ctime(*timeWindow) ctime(firsttime) ctime(lasttime)