Sigma high test sigma

Okta FastPass Phishing Detection

Detects when Okta FastPass prevents a known phishing site.

View Source

Detection Logic

{
  "selection": {
    "outcome.reason": "FastPass declined phishing attempt",
    "outcome.result": "FAILURE",
    "eventType": "user.authentication.auth_via_mfa"
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...