infrastructure

infrastructure rule

Title	Tags
false positives may be present. tune okta and tune the analytic to ensure proper fidelity. modify risk score as needed. drop to anomaly until tuning is complete.	t1110 infrastructure okta tenant splunk
false positives may occur. it is recommended to fine-tune okta settings and the analytic to ensure high fidelity. adjust the risk score as necessary.	t1078 t1078.004 infrastructure splunk
fidelity of this is high as it is okta threatinsight. filter and modify as needed.	t1078 t1078.001 T1110.003 T1110.004 infrastructure splunk
fidelity of this is high as okta is specifying malicious infrastructure. filter and modify as needed.	t1078 t1078.001 t1556 infrastructure splunk
none currently known	t1200 t1498 t1557 T1557.002 infrastructure splunk
none. account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.	t1078 t1078.001 infrastructure splunk
there may be a faulty config preventing legitmate users from accessing apps they should have access to.	t1078 t1078.001 infrastructure splunk
this search might be prone to high false positives if dhcp snooping has been incorrectly configured or in the unlikely event that the dhcp server has been moved to another network interface.	t1200 t1498 t1557 infrastructure splunk
this search might be prone to high false positives if dhcp snooping or arp inspection has been incorrectly configured, or if a device normally sends many arp packets (unlikely).	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.	t1200 t1498 t1557 T1557.002 infrastructure splunk
this search might be prone to high false positives. please consider this when conducting analysis or investigations. authorized devices may be detected as unauthorized. if this is the case, verify the mac address of the system responsible for the false positive and add it to the assets and identity framework with the proper information.	infrastructure splunk
this search will also report any legitimate attempts of software downloads to network devices as well as outbound ssh sessions from network devices.	t1542 T1542.005 infrastructure splunk
this search will return false positives for any legitimate traffic captures by network administrators.	t1020 T1020.001 t1200 t1498 infrastructure splunk