[metadata]
creation_date = "2020/08/19"
maturity = "production"
updated_date = "2020/10/26"

[rule]
author = ["Elastic"]
description = """
Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute
force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy
ensures that a user account is locked out after 10 failed authentication attempts.
"""
from = "now-180m"
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License"
name = "Attempts to Brute Force an Okta User Account"
note = "The Okta Fleet integration or Filebeat module must be enabled to use this rule."
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
]
risk_score = 47
rule_id = "e08ccd49-0380-4b2b-8d71-8000377d6e49"
severity = "medium"
tags = ["Elastic", "Identity", "Okta", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "threshold"

query = '''
event.dataset:okta.system and event.action:user.account.lock
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.threshold]
field = "okta.actor.id"
value = 3

