mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
65 lines
3.1 KiB
YAML
65 lines
3.1 KiB
YAML
name: Okta Risk Threshold Exceeded
|
|
id: d8b967dd-657f-4d88-93b5-c588bcd7218c
|
|
version: 1
|
|
date: '2022-09-29'
|
|
author: Michael Haag, Splunk
|
|
type: Correlation
|
|
datamodel:
|
|
- Risk
|
|
description: The following correlation will take risk associated with the content from "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories and tally it up. Once it hits the threshold of 100 (may be changed), it will trigger an anomaly. As needed, reduce or raise the risk scores assocaited with the anomaly and TTP analytics tagged to these two stories.
|
|
search: '| tstats `summariesonly` sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk by All_Risk.risk_object,All_Risk.risk_object_type All_Risk.analyticstories
|
|
| `drop_dm_object_name("All_Risk")`
|
|
| eval "annotations.mitre_attack"="annotations.mitre_attack.mitre_technique_id", risk_threshold=100
|
|
| where All_Risk.analyticstories IN ("Suspicious Okta Activity", "Okta MFA Exhaustion") risk_score > $risk_threshold$
|
|
| `get_risk_severity(risk_score)`
|
|
| `okta_risk_threshold_exceeded_filter`'
|
|
how_to_implement: Ensure "Suspicious Okta Activity" and "Okta MFA Exhaustion" analytic stories are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on risk before generating a notable. Modify the value as needed. Default threshold is 100. This value may need to be increased based on activity in your environment.
|
|
known_false_positives: False positives will be limited to the amount of events generated by the analytics tied to the stories. Analytics will need to be tesetd and tuned, risk score reduced, as needed based on organization.
|
|
references:
|
|
- https://developer.okta.com/docs/reference/api/event-types
|
|
- https://sec.okta.com/everythingisyes
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious Okta Activity
|
|
- Okta MFA Exhaustion
|
|
asset_type: Infrastructure
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
confidence: 80
|
|
context:
|
|
- Other:Brute Force
|
|
- Scope:External
|
|
- Source:Correlation
|
|
dataset: []
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Reconnaissance
|
|
- Exploitation
|
|
message: Risk threshold exceeded for $risk_object_type$=$risk_object$ related to Okta events.
|
|
mitre_attack_id:
|
|
- T1078
|
|
- T1110
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: risk_object
|
|
type: Other
|
|
role:
|
|
- Victim
|
|
- name: risk_object_type
|
|
type: Other
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- All_Risk.risk_object
|
|
- All_Risk.risk_object_type
|
|
- All_Risk.analyticstories
|
|
risk_score: 56
|
|
security_domain: access
|