admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-04-17 13:11:24 -07:00
committed by GitHub
parent 6955f7d8c6 03041105aa
commit febf103b87
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/application/okta_risk_threshold_exceeded.yml
+1 -1
View File
@@ -22,7 +22,7 @@ search:
dc(source) as source_count from datamodel=Risk.All_Risk by All_Risk.risk_object,All_Risk.risk_object_type
All_Risk.analyticstories | `drop_dm_object_name("All_Risk")` | eval "annotations.mitre_attack"="annotations.mitre_attack.mitre_technique_id",
risk_threshold=100 | where All_Risk.analyticstories IN ("Suspicious Okta Activity",
"Okta MFA Exhaustion") risk_score > $risk_threshold$ | `get_risk_severity(risk_score)`
"Okta MFA Exhaustion") risk_score > risk_threshold | `get_risk_severity(risk_score)`
| `okta_risk_threshold_exceeded_filter`'
how_to_implement:
Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic