Okta Core

eventTypeDescriptionSampleRule
core.concurrency.org.limit.violationToo many requests in flight.YY
core.el.evaluateEvaluate Expression Language.NN
core.user_auth.idp.x509.crl_download_failureFailed to download CRL from the endpoint.NN

core.concurrency.org.limit.violation

#

Description

Too many requests in flight.

Example System Log Event #

{
  "published": 1782141604302,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000067",
  "actor": {
    "id": "0oa00000000000000112",
    "type": "PublicClientAppEntity",
    "alternateId": "user06@dw-harness.example",
    "displayName": "DW Harness 42",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "okta-sdk-python/2.9.13 python/3.12.13 Linux/5.10.253-286.1015.amzn2.x86_64",
      "os": "Linux",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.16",
    "geographicalContext": null
  },
  "device": null,
  "events": null,
  "target": null,
  "outcome": null,
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.16",
        "geographicalContext": null,
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      },
      {
        "ip": "192.0.2.23",
        "geographicalContext": null,
        "version": "V4",
        "source": null
      }
    ]
  },
  "version": "0",
  "severity": "WARN",
  "eventType": "core.concurrency.org.limit.violation",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000034",
    "detail": {
      "rootApiTokenId": "0000000000000000000000000000000000000000000017",
      "requestApiTokenId": "0000000000000000000000000000000000000000000017",
      "requestApiTokenClientId": "0oa00000000000000112"
    }
  },
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000034",
      "requestUri": "00000000000000000000000000000000000000010",
      "url": "00000000000000000000000000000000000000010?"
    }
  },
  "displayMessage": "Too many requests in flight",
  "gatewayContext": null,
  "legacyEventType": "core.concurrency.org.limit.violation",
  "resourceDetails": null,
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000245",
    "externalSessionId": "trs00000000000000245"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Panther #

References #

core.el.evaluate

#

Description

Evaluate Expression Language.

References #

core.user_auth.idp.x509.crl_download_failure

#

Description

Failed to download CRL from the endpoint.

References #