LoFP LoFP / T1538

T1538

TitleTags
false positives may be present based on organization size and configuration of okta.
legitimate administrators or automation tools may access ssm inventory apis for asset management or compliance purposes. verify whether the user identity should be using these apis. if known behavior is causing false positives, add exceptions.