[metadata]
creation_date = "2020/07/16"
maturity = "production"
updated_date = "2020/10/26"

[rule]
author = ["Elastic"]
description = """
Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative
of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to
obtain unauthorized access to user accounts.
"""
false_positives = [
    """
    Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false
    positives.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License"
name = "Okta Brute Force or Password Spraying Attack"
note = "The Okta Fleet integration or Filebeat module must be enabled to use this rule."
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
]
risk_score = 47
rule_id = "42bf698b-4738-445b-8231-c834ddefd8a0"
severity = "medium"
tags = ["Elastic", "Identity", "Okta", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "threshold"

query = '''
event.dataset:okta.system and event.category:authentication and event.outcome:failure
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.threshold]
field = "source.ip"
value = 25

