From ab8ab6d5966f5d013d5dfcda37544ff99bc99786 Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Mon, 27 Nov 2023 17:39:10 -0500 Subject: [PATCH] [New Rule] Adding Detection for New Okta Authentication Behavior (#3260) * new rule 'New Okta Authentication Behavior Detected' * Update rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> (cherry picked from commit f19506f3a21872dd0d3b8f4b23749068bb97c953) --- ...new_authentication_behavior_detection.toml | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml diff --git a/rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml b/rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml new file mode 100644 index 000000000..72f8d4059 --- /dev/null +++ b/rules/integrations/okta/initial_access_new_authentication_behavior_detection.toml @@ -0,0 +1,77 @@ +[metadata] +creation_date = "2023/11/07" +integration = ["okta"] +maturity = "production" +min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0" +min_stack_version = "8.10.0" +updated_date = "2023/11/07" + +[rule] +author = ["Elastic"] +description = "Detects events where Okta behavior detection has identified a new authentication behavior." +from = "now-30m" +index = ["filebeat-*", "logs-okta*"] +interval = "15m" +language = "kuery" +license = "Elastic License v2" +name = "New Okta Authentication Behavior Detected" +note = """## Triage and analysis + +### Investigating New Okta Authentication Behavior Detected + +This rule detects events where Okta behavior detection has identified a new authentication behavior such as a new device or location. + +#### Possible investigation steps: +- Identify the user involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields. +- Determine the authentication anomaly by examining the `okta.debug_context.debug_data.risk_behaviors` and `okta.debug_context.debug_data.flattened` fields. +- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields. +- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields. +- Review the past activities of the actor involved in this action by checking their previous actions. +- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action. +- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity. + +### False positive analysis: +- A user may be using a new device or location to sign in. +- The Okta behavior detection may be incorrectly identifying a new authentication behavior and need adjusted. + +### Response and remediation: +- If the user is legitimate and the authentication behavior is not suspicious, no action is required. +- If the user is legitimate but the authentication behavior is suspicious, consider resetting the user's password and enabling multi-factor authentication (MFA). + - If MFA is already enabled, consider resetting MFA for the user. +- If the user is not legitimate, consider deactivating the user's account. +- If this is a false positive, consider adjusting the Okta behavior detection settings. +- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields. +- Conduct a review of Okta policies and ensure they are in accordance with security best practices. + +## Setup + +The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule. +""" +references = [ + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy", + "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection", + "https://unit42.paloaltonetworks.com/muddled-libra/", + "https://help.okta.com/oie/en-us/content/topics/security/behavior-detection/about-behavior-detection.htm", +] +risk_score = 47 +rule_id = "260486ee-7d98-11ee-9599-f661ea17fbcd" +severity = "medium" +tags = [ + "Use Case: Identity and Access Audit", + "Tactic: Initial Access", + "Data Source: Okta", +] +timestamp_override = "event.ingested" +type = "query" + +query = '''event.dataset:okta.system and okta.debug_context.debug_data.risk_behaviors:*''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0001" +name = "Initial Access" +reference = "https://attack.mitre.org/tactics/TA0001/" +