[New Rule] Adding Detection for New Okta Authentication Behavior (#3260)

* new rule 'New Okta Authentication Behavior Detected' * Update rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> (cherry picked from commit f19506f3a2)
2023-11-27 17:39:10 -05:00
parent 315b4df8ca
commit ab8ab6d596
1 changed files with 77 additions and 0 deletions
@@ -0,0 +1,77 @@
+[metadata]
+creation_date = "2023/11/07"
+integration = ["okta"]
+maturity = "production"
+min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
+min_stack_version = "8.10.0"
+updated_date = "2023/11/07"
+
+[rule]
+author = ["Elastic"]
+description = "Detects events where Okta behavior detection has identified a new authentication behavior."
+from = "now-30m"
+index = ["filebeat-*", "logs-okta*"]
+interval = "15m"
+language = "kuery"
+license = "Elastic License v2"
+name = "New Okta Authentication Behavior Detected"
+note = """## Triage and analysis
+
+### Investigating New Okta Authentication Behavior Detected
+
+This rule detects events where Okta behavior detection has identified a new authentication behavior such as a new device or location.
+
+#### Possible investigation steps:
+- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the authentication anomaly by examining the `okta.debug_context.debug_data.risk_behaviors` and `okta.debug_context.debug_data.flattened` fields.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+### False positive analysis:
+- A user may be using a new device or location to sign in.
+- The Okta behavior detection may be incorrectly identifying a new authentication behavior and need adjusted.
+
+### Response and remediation:
+- If the user is legitimate and the authentication behavior is not suspicious, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the user.
+- If the user is not legitimate, consider deactivating the user's account.
+- If this is a false positive, consider adjusting the Okta behavior detection settings.
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+
+## Setup
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+"""
+references = [
+    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
+    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
+    "https://unit42.paloaltonetworks.com/muddled-libra/",
+    "https://help.okta.com/oie/en-us/content/topics/security/behavior-detection/about-behavior-detection.htm",
+]
+risk_score = 47
+rule_id = "260486ee-7d98-11ee-9599-f661ea17fbcd"
+severity = "medium"
+tags = [
+    "Use Case: Identity and Access Audit",
+    "Tactic: Initial Access",
+    "Data Source: Okta",
+]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''event.dataset:okta.system and okta.debug_context.debug_data.risk_behaviors:*'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+