Okta Fast Pass phishing Detection

// Add any known good IPs to this list to reduce noise
let AllowedIPList = dynamic([]);
OktaSSO
| where isnotempty(client_ipAddress_s) and client_ipAddress_s !in (AllowedIPList)
| where eventType_s == 'user.authentication.auth_via_mfa'
| where outcome_result_s == 'FAILURE'
| where outcome_reason_s == 'FastPass declined phishing attempt'
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,
 outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), column_ifexists('debugContext_debugData_threatSuspected_s', ""), client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_city_s, client_geographicalContext_country_s
| extend Location = strcat(client_geographicalContext_city_s, "-", client_geographicalContext_country_s), AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])