Detection rules › By event
Okta-user
user.account.lock
#5 detection rules reference this event. View event page.Sigma (1)
Elastic (1)
Splunk (1)
YARA-L (1)
Panther (1)
user.account.lock.limit
#2 detection rules reference this event. View event page.YARA-L (1)
Panther (1)
user.account.privilege.grant
#4 detection rules reference this event. View event page.Sigma (1)
Elastic (1)
Kusto (1)
Panther (1)
user.account.report_suspicious_activity_by_enduser
#5 detection rules reference this event. View event page.Sigma (1)
Elastic (1)
Splunk (1)
YARA-L (1)
Panther (1)
user.account.reset_password
#2 detection rules reference this event. View event page.YARA-L (1)
Panther (1)
user.account.unlock_token
#1 detection rules reference this event. View event page.Elastic (1)
user.authentication.auth
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_identifier_not_in_policy
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_unconfigured_identifier
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_via_AD_agent
#12 detection rules reference this event. View event page.Elastic (10)
Panther (2)
user.authentication.auth_via_IDP
#12 detection rules reference this event. View event page.Elastic (11)
Panther (1)
user.authentication.auth_via_LDAP_agent
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_via_inbound_SAML
#11 detection rules reference this event. View event page.Elastic (11)
user.authentication.auth_via_inbound_delauth
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_via_iwa
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_via_mfa
#29 detection rules reference this event. View event page.Sigma (1)
Elastic (15)
Splunk (5)
Kusto (2)
YARA-L (5)
Panther (1)
user.authentication.auth_via_radius
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.auth_via_richclient
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.authenticate
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.dsso_via_non_priority_source
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.slo
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.sso
#21 detection rules reference this event. View event page.Elastic (15)
Splunk (1)
YARA-L (1)
Panther (4)
user.authentication.universal_logout
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.universal_logout.scheduled
#10 detection rules reference this event. View event page.Elastic (10)
user.authentication.verify
#15 detection rules reference this event. View event page.Elastic (14)
Splunk (1)
user.lifecycle.activate
#1 detection rules reference this event. View event page.Sigma (1)
user.lifecycle.create
#2 detection rules reference this event. View event page.Sigma (2)
user.mfa.attempt_bypass
#3 detection rules reference this event. View event page.Elastic (1)
Kusto (1)
Panther (1)
user.mfa.factor.activate
#3 detection rules reference this event. View event page.Elastic (1)
Panther (2)
user.mfa.factor.deactivate
#5 detection rules reference this event. View event page.Sigma (1)
Elastic (1)
Splunk (1)
Kusto (1)
YARA-L (1)
user.mfa.factor.reset_all
#6 detection rules reference this event. View event page.Sigma (1)
Elastic (2)
Kusto (1)
YARA-L (1)
Panther (1)
user.mfa.factor.suspend
#2 detection rules reference this event. View event page.Kusto (1)
Panther (1)
user.mfa.factor.update
#2 detection rules reference this event. View event page.Elastic (1)
Panther (1)
user.mfa.okta_verify.deny_push
#4 detection rules reference this event. View event page.Elastic (2)
Kusto (1)
YARA-L (1)
user.session.access_admin_app
#1 detection rules reference this event. View event page.Kusto (1)
user.session.impersonation.grant
#2 detection rules reference this event. View event page.Kusto (1)
Panther (1)
user.session.impersonation.initiate
#3 detection rules reference this event. View event page.Elastic (1)
Kusto (1)
Panther (1)
user.session.start
#31 detection rules reference this event. View event page.Sigma (1)
Elastic (14)
Splunk (2)
Kusto (5)
YARA-L (2)
Panther (7)