Anvilogic high experimental other

Okta User Reported Suspicious Activity [snowflake-okta]

Detect when a user has reported suspicious activity - Threat Actor Association: Scatter Swine

View Source

Detection Logic

select * from okta where event_time > dateadd(hour, -2, sysdate()) and event_type ilike 'user.account.report_suspicious_activity_by_enduser'

Field Validations

Loading…

Comments (0)

Loading comments...