Okta Core
| eventType | Description | Sample | Rule |
|---|---|---|---|
| core. | Too many requests in flight. | Y | Y |
| core. | Evaluate Expression Language. | N | N |
| core. | Failed to download CRL from the endpoint. | N | N |
core.concurrency.org.limit.violation
#Description
Too many requests in flight.
Example System Log Event #
{
"published": 1782141604302,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000067",
"actor": {
"id": "0oa00000000000000112",
"type": "PublicClientAppEntity",
"alternateId": "user06@dw-harness.example",
"displayName": "DW Harness 42",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "okta-sdk-python/2.9.13 python/3.12.13 Linux/5.10.253-286.1015.amzn2.x86_64",
"os": "Linux",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Computer",
"id": null,
"ipAddress": "192.0.2.16",
"geographicalContext": null
},
"device": null,
"events": null,
"target": null,
"outcome": null,
"request": {
"ipChain": [
{
"ip": "192.0.2.16",
"geographicalContext": null,
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
{
"ip": "192.0.2.23",
"geographicalContext": null,
"version": "V4",
"source": null
}
]
},
"version": "0",
"severity": "WARN",
"eventType": "core.concurrency.org.limit.violation",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000034",
"detail": {
"rootApiTokenId": "0000000000000000000000000000000000000000000017",
"requestApiTokenId": "0000000000000000000000000000000000000000000017",
"requestApiTokenClientId": "0oa00000000000000112"
}
},
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000034",
"requestUri": "00000000000000000000000000000000000000010",
"url": "00000000000000000000000000000000000000010?"
}
},
"displayMessage": "Too many requests in flight",
"gatewayContext": null,
"legacyEventType": "core.concurrency.org.limit.violation",
"resourceDetails": null,
"securityContext": {
"asNumber": null,
"asOrg": null,
"isp": null,
"domain": null,
"isProxy": null
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000245",
"externalSessionId": "trs00000000000000245"
}
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
Panther #
T1110, T1498