LoFP LoFP / okta

okta rule

TitleTags
a user may have multiple sessions open at the same time, such as on a mobile device and a laptop.
a user may report suspicious activity on their okta account in error.
a windows administrator may have triggered a low-fidelity credential access alert during a legitimate administrative action. following this, the administrator may have reset the mfa credentials for themselves and then logged into the okta console for ad directory services integration management.
administrator roles could be assigned to users or group by other admin users.
administrator roles may be assigned to okta users by a super admin user. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.
an okta admnistrator may be logged into multiple accounts from the same host for legitimate reasons.
automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
consider adding exceptions to this rule to filter false positives if okta mfa rules are regularly modified in your organization.
consider adding exceptions to this rule to filter false positives if okta policies are regularly modified in your organization.
consider adding exceptions to this rule to filter false positives if oyour organization's okta network zones are regularly modified.
consider adding exceptions to this rule to filter false positives if sign on policies for okta applications are regularly modified or deleted in your organization.
consider adding exceptions to this rule to filter false positives if the mfa factors for okta user accounts are regularly reset in your organization.
consider adding exceptions to this rule to filter false positives if your organization's okta applications are regularly modified and the behavior is expected.
false positives are expected if administrators access these function through proxy legitimatly. apply additional filters if necessary
if a mfa reset or deactivated was performed by a system administrator.
if a user requires an anonymising proxy due to valid justifications.
if an end-user incorrectly identifies normal activity as suspicious.
if the behavior of creating okta api tokens is expected, consider adding exceptions to this rule to filter false positives.
if the behavior of deactivating mfa for okta user accounts is expected, consider adding exceptions to this rule to filter false positives.
if the behavior of deactivating okta policies is expected, consider adding exceptions to this rule to filter false positives.
if the behavior of revoking okta api tokens is expected, consider adding exceptions to this rule to filter false positives.
legitimate and authorized user creation
legitimate creation of a new admin role assignment
legitimate creation of an api token by authorized users
okta policies being modified or deleted may be performed by a system administrator.
okta policies modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
shared systems such as kiosks and conference room computers may be used by multiple users.
the number of okta user password reset or account unlock attempts will likely vary between organizations. to fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule.
unlikely
user might of believe that they had access.
users may share an endpoint related to work or personal use in which separate okta accounts are used.
when an admin creates a new, authorised identity provider.
whenever an admin starts using new features of the admin console.