Back Id e36c6bd6-f86a-4282-93a5-b4a1b48dd849 Rulename Device Registration from Malicious IP Description This query identifies Device Registration from IP addresses identified as malicious by Okta ThreatInsight. Severity High Tactics Persistence Techniques T1098 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/DeviceRegistrationMaliciousIP.yaml Version 1.1.1 Arm template e36c6bd6-f86a-4282-93a5-b4a1b48dd849.json
KQL let Events = dynamic(["device.enrollment.create"]); let ThreatInsightOperations = dynamic(["security.threat.detected", "security.
Back Id 884be6e7-e568-418e-9c12-89229865ffde Rulename Failed Logins from Unknown or Invalid User Description This query searches for numerous login attempts to the management console with an unknown or invalid user name. Severity Medium Tactics CredentialAccess Techniques T1110 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml Version 1.1.1 Arm template 884be6e7-e568-418e-9c12-89229865ffde.json
KQL let FailureThreshold = 15; let FailedLogins = OktaSSO | where eventType_s =~ "user.
Back Id 9f82a735-ae43-4c03-afb4-d5d153e1ace1 Rulename High-Risk Admin Activity Description The Okta risk engine auto-assigns risk levels to each login attempt. This query identifies admin operations originating from events associated with high-risk profiles. Severity Medium Tactics Persistence Techniques T1098 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/HighRiskAdminActivity.yaml Version 1.1.1 Arm template 9f82a735-ae43-4c03-afb4-d5d153e1ace1.json
KQL let AdminActivity = dynamic(["iam.
Back Id c2697b81-7fe9-4f57-ba1d-de46c6f91f9c Rulename MFA Fatigue (OKTA) Description MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into providing their MFA details thus compromising their own security. The query identifies MFA fatigue attempts in the Okta data. Ref: https://www.okta.com/blog/identity-security/mfa-fatigue-growing-security-concern/. Severity Medium Tactics CredentialAccess Techniques T1621 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.
Back Id 41e843a8-92e7-444d-8d72-638f1145d1e1 Rulename New Device/Location sign-in along with critical operation Description This query identifies users seen login from new geo location/country as well as a new device and performing critical operations. Severity Medium Tactics InitialAccess
Persistence Techniques T1078
T1556 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/NewDeviceLocationCriticalOperation.yaml Version 1.1.1 Arm template 41e843a8-92e7-444d-8d72-638f1145d1e1.
Back Id e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508 Rulename Potential Password Spray Attack Description This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack. Severity Medium Tactics CredentialAccess Techniques T1110.003 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 1h Query period 1h Trigger threshold 0 Trigger operator gt Source Uri https://github.
Back Id 2954d424-f786-4677-9ffc-c24c44c6e7d5 Rulename User Login from Different Countries within 3 hours Description This query searches for successful user logins to the Okta Console from different countries within 3 hours. Severity High Tactics InitialAccess Techniques T1078.004 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 3h Query period 3h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/LoginfromUsersfromDifferentCountrieswithin3hours.yaml Version 1.1.1 Arm template 2954d424-f786-4677-9ffc-c24c44c6e7d5.json
KQL let timeframe = ago(3h); let threshold = 2; OktaSSO | where column_ifexists('published_t', now()) >= timeframe | where eventType_s =~ "user.
Back Id 35846296-4052-4de2-8098-beb6bb5f2203 Rulename User Session Impersonation(Okta) Description A user has started a session impersonation, gaining access with the impersonated users permissions. This typically signifies Okta admin access and should only happen if anticipated and requested. Severity Medium Tactics PrivilegeEscalation Techniques T1134
T1134.003 Required data connectors OktaSSO
OktaSSOv2 Kind Scheduled Query frequency 6h Query period 6h Trigger threshold 0 Trigger operator gt Source Uri https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/UserSessionImpersonation.yaml Version 1.
