Anvilogic high experimental other

Okta: Admin App Accessed [snowflake-okta]

This use case detects when a user has accessed the Okta admin app.

View Source

Detection Logic

select * from okta where event_time > dateadd(hour, -2, sysdate()) and to_timestamp(date_part(epoch_second, event_time)) < $latest$ and event_type ilike 'user.session.access_admin_app'

Field Validations

Loading…

Comments (0)

Loading comments...