Elastic high stable kql

Attempted Bypass of Okta MFA

Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.

View Source

Detection Logic

data_stream.dataset:okta.system and event.action:user.mfa.attempt_bypass

Field Validations

Loading…

Comments (0)

Loading comments...