Anvilogic high experimental other

Okta: User impersonation [snowflake-okta]

User.session.impersonation events are normally triggered when an Okta Support person requests admin access.

View Source

Detection Logic

select * from okta where event_time > dateadd(hour, -2, sysdate()) and (event_type ilike 'user.session.impersonation.initiate' or event_type ilike 'user.session.impersonation.grant' or event_type ilike 'user.session.impersonation.extend' or event_type ilike 'user.session.impersonation.end' or event_type ilike 'user.session.impersonation.revoke' )

Field Validations

Loading…

Comments (0)

Loading comments...