Malicious authentication attempt detected by Okta ThreatInsight
Set up the okta integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect malicious Okta authentication attempts based on Okta ThreatInsight.
Strategy
This rule lets you monitor Okta authentication attempts where the @evt.name is security.threat.detected and the @debugContext.debugData.threatSuspected value is true.
Okta ThreatInsight uses these attributes to flag authentication attempts that are deemed as threats.
Triage and response
- Determine if the source IP
{{@network.client.ip}} is anomalous within the organization:- Does threat intelligence indicate that this IP has been associated with malicious activity?
- Is the geo-location, ASN, or domain uncommon for the organization?
- Use the Cloud SIEM - IP Investigation dashboard to see if the IP address has taken other actions.
- Investigate the
debugContext.debugData.threatDetections field to determine the threat reason and level. - If the IP is deemed malicious:
- Confirm that no successful authentication attempts have been made.
- If a successful authentication attempt is observed, begin your company’s incident response process.
Changelog
- 13 September 2023 - Updated
critical case severities to medium and medium case severities to low.
