David French 6d3955bd8a [New Rule] High Number of Okta User Password Reset or Unlock Attempts (#187) ...

* new-rule-high-number-of-okta-password-reset-or-unlock-attempts

* Update rules/okta/credential_access_suspicious_okta_user_password_reset_or_unlock_attempts.toml

Update ecs_version

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/okta/credential_access_suspicious_okta_user_password_reset_or_unlock_attempts.toml

Update schedule

* Update FP information and format query for readability

* Update .gitignore

* Update rules/okta/credential_access_suspicious_okta_user_password_reset_or_unlock_attempts.toml

* Tweak formatting of query

* Update rules/okta/credential_access_suspicious_okta_user_password_reset_or_unlock_attempts.toml

Update description

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2020-09-04 08:38:06 -06:00

..

credential_access_attempted_bypass_of_okta_mfa.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

credential_access_attempts_to_brute_force_okta_user_account.toml

[New Rule] Attempts to Brute Force an Okta User Account (#186)

2020-09-03 11:23:56 -06:00

credential_access_okta_brute_force_or_password_spraying.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

credential_access_suspicious_okta_user_password_reset_or_unlock_attempts.toml

[New Rule] High Number of Okta User Password Reset or Unlock Attempts (#187)

2020-09-04 08:38:06 -06:00

impact_attempt_to_revoke_okta_api_token.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

impact_possible_okta_dos_attack.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

initial_access_suspicious_activity_reported_by_okta_user.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_deactivate_okta_mfa_rule.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_delete_okta_policy.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_modify_okta_mfa_rule.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_modify_okta_network_zone.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_modify_okta_policy.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

okta_threat_detected_by_okta_threatinsight.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

persistence_administrator_privileges_assigned_to_okta_group.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

persistence_attempt_to_create_okta_api_token.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

persistence_attempt_to_deactivate_okta_policy.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00

persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml

Add ECS 1.6.0 schema for validation testing (#220)

2020-08-27 11:54:49 -05:00