Update okta_fastpass_phishing_detection.yml

2023-05-08 10:35:19 -05:00
parent df04652768
commit 8dc803df95
1 changed files with 3 additions and 3 deletions
@@ -16,11 +16,11 @@ logsource:
    service: okta
 detection:
    selection:
-        displaymessage: FastPass declined phishing attempt
-        status: FAILURE
+        outcome.reason: 'FastPass declined phishing attempt'
+        outcome.result: FAILURE
        eventtype:
            - user.authentication.auth_via_mfa
    condition: selection
 falsepositives:
-    - Unknown
+    - Unlikely
 level: high