Detection rules › By event

Okta-security

Event	Rules
security.attack.end	1
security.attack.start	2
security.threat.detected	8

security.attack.end

1 detection rules reference this event. View event page.

Kusto (1)

Device Registration from Malicious IP severity high T1098, T1098.005

security.attack.start

2 detection rules reference this event. View event page.

Kusto (1)

Device Registration from Malicious IP severity high T1098, T1098.005

YARA-L (1)

Okta ThreatInsight Targeted Bruteforce Attack severity medium T1110

security.threat.detected

8 detection rules reference this event. View event page.

Sigma (1)

Okta Security Threat Detected severity medium

Elastic (1)

Okta ThreatInsight Threat Suspected Promotion severity medium

Splunk (1)

Okta ThreatInsight Threat Detected severity low T1078, T1078.004

Kusto (1)

Device Registration from Malicious IP severity high T1098, T1098.005

YARA-L (3)

Okta ThreatInsight Login Failure With High Unknown Users severity medium T1110, T1110.004
Okta ThreatInsight Suspected Bruteforce Attack severity medium T1110, T1110.001
Okta ThreatInsight Suspected Password Spray Attack severity medium T1110, T1110.003

Panther (1)

Okta ThreatInsight Security Threat Detected severity high