Anvilogic high experimental spl

Okta: Admin App Accessed [splunk-okta]

This use case detects when a user has accessed the Okta admin app.

View Source

Detection Logic

`get_application_data` eventType="user.session.access_admin_app" `group_events("src_ip", 1)`

Field Validations

Loading…

Comments (0)

Loading comments...