Terrance DeJesus f3d55185c2 [New Rule] Threshold Detections for Okta User Sessions and Client Addresses (#3263) ...

* new Okta threshold rules for client addresses and sessions

* adjusting references

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/initial_access_multiple_client_addresses_with_single_okta_session.toml

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

(cherry picked from commit 0578bd4caa)

2023-11-28 00:07:30 +00:00

..

credential_access_attempted_bypass_of_okta_mfa.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

credential_access_attempts_to_brute_force_okta_user_account.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

credential_access_mfa_push_brute_force.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

credential_access_okta_brute_force_or_password_spraying.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

credential_access_user_impersonation_access.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_attempt_to_deactivate_okta_network_zone.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_attempt_to_delete_okta_network_zone.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_deactivate_okta_policy.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_delete_okta_policy.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_modify_okta_network_zone.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_okta_attempt_to_modify_okta_policy.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

impact_attempt_to_revoke_okta_api_token.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

impact_okta_attempt_to_deactivate_okta_application.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

impact_okta_attempt_to_delete_okta_application.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

impact_okta_attempt_to_modify_okta_application.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

impact_possible_okta_dos_attack.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

initial_access_first_occurrence_user_session_started_via_proxy.toml

[New Rule] Adding Detection for First Occurrence of Okta User Session Started via Proxy (#3261)

2023-11-27 22:54:46 +00:00

initial_access_multiple_client_addresses_with_single_okta_session.toml

[New Rule] Threshold Detections for Okta User Sessions and Client Addresses (#3263)

2023-11-28 00:07:30 +00:00

initial_access_new_authentication_behavior_detection.toml

[New Rule] Adding Detection for New Okta Authentication Behavior (#3260)

2023-11-27 22:43:48 +00:00

initial_access_okta_user_attempted_unauthorized_access.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

initial_access_okta_user_sessions_started_from_different_geolocations.toml

[New Rule] Adding Detection Logic for Okta User Sessions Started from Different Geolocations (#3279)

2023-11-21 22:36:50 +00:00

initial_access_sign_in_events_via_third_party_idp.toml

[New Rule] Detection for Okta Sign-In Events via Third-Party IdP (#3259)

2023-11-27 23:35:54 +00:00

initial_access_suspicious_activity_reported_by_okta_user.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

lateral_movement_multiple_sessions_for_single_user.toml

[New Rule] Threshold Detections for Okta User Sessions and Client Addresses (#3263)

2023-11-28 00:07:30 +00:00

okta_threatinsight_threat_suspected_promotion.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_administrator_privileges_assigned_to_okta_group.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_administrator_role_assigned_to_okta_user.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_attempt_to_create_okta_api_token.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00

persistence_new_idp_successfully_added_by_admin.toml

adding new rule 'New Okta Identity Provider (IdP) Added by Admin' (#3258)

2023-11-27 23:11:28 +00:00

persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)

2023-10-24 16:58:20 +00:00