Okta rapid application access
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detects rapid access to multiple Okta applications from a new device and geographic location.
Strategy
This rule monitors successful user.authentication.sso events to Okta application instances when behavior detection identifies both a new device and a new geographic location. Rapid access across several applications can expose unauthorized use of a compromised Okta account.
Triage and response
- Verify with
{{@usr.email}} whether the application access was expected from the observed device and location. - Review the applications accessed by the user and identify sensitive or administrative resources.
- Examine recent authentication, MFA, IP address, user-agent, and session activity associated with the account.
