Anvilogic high experimental spl

Okta User Reported Suspicious Activity [splunk-okta]

Detect when a user has reported suspicious activity - Threat Actor Association: Scatter Swine

View Source

Detection Logic

`get_application_data` eventType="user.account.report_suspicious_activity_by_enduser"
| eval activity='debugContext.debugData.suspiciousActivityEventType'
| table _time, host, user, action, dest_host, src_ip, src_user, signature, reason, activity
| bin span=1s
| stats values(*) as * by _time, src_ip

Field Validations

Loading…

Comments (0)

Loading comments...