Elastic medium stable kql

First Occurrence of Okta User Session Started via Proxy

Identifies the first occurrence of an Okta user session started via a proxy.

View Source

Detection Logic

data_stream.dataset:okta.system and
    okta.event_type: (
        user.session.start or
        user.authentication.verify or
        user.authentication.sso or
        user.authentication.auth_via_mfa
    ) and
    okta.security_context.is_proxy:true and
    not okta.actor.id: okta*

Field Validations

Loading…

Comments (0)

Loading comments...