if a user requires an anonymising proxy due to valid justifications.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/okta/okta_user_session_start_via_anonymised_proxy.yml>sigma
technicques: t1562 t1562.006

Techniques

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

condition: selection
selection:
  eventtype: user.session.start
  securitycontext.isproxy: 'true'