Anvilogic high experimental spl

Okta: Multiple OKTA push requests [splunk-okta]

This use case looks for when a user has received multiple push requests for authentication via Okta.

View Source

Detection Logic

`get_application_data` eventType="system.push.send_factor_verify_push"
| table _time, host, user, action, dest_host, src_ip, src_user, signature, reason
| bin span=1s
| stats values(*) as * by _time, user
| eventstats count(signature) as c_signature by user
| where c_signature > 4

Field Validations

Loading…

Comments (0)

Loading comments...