Okta temporary password granted and MFA reset
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detects an administrator issuing a temporary password followed by the reset of all MFA factors for the Okta user.
Strategy
This rule monitors Okta account recovery and factor administration events. Alerts when both user.account.expire_password and user.mfa.factor.reset_all succeed for the same account.
When an administrator expires a user password, there’s an option to generate a temporary password for the user which can be used by an attacker to login and set their own. When factors are reset, an attacker can also add multi-factor authentication devices. The detailed behavior can represent an account takeover especially when activity occurs from uncommon geo-location or hosting provider IP addresses.
The rule severity is increased if Datadog detects the IP address is associated with a hosting provider.
Triage & Response
- Identify the permissions of the affected user,
{{@target.alternateId}}, including if they have administrator privileges within your Okta instance. - Review internal tickets for evidence this change was associated with a related request.
- Examine the source IP
{{@network.client.ip}}, geo‑location, and associated domain. - If user activity is suspicious, begin your organization’s incident response process and investigate for any account takeovers.
