Detection: Okta ThreatInsight Threat Detected

Updated Date: 2025-01-21 ID: 140504ae-5fe2-4d65-b2bc-a211813fbca6 Author: Michael Haag, Mauricio Velazco, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies threats detected by Okta ThreatInsight, such as password spraying, login failures, and high counts of unknown user login attempts. It leverages Okta Identity Management logs, specifically focusing on security.threat.detected events. This activity is significant for a SOC as it highlights potential unauthorized access attempts and credential-based attacks. If confirmed malicious, these activities could lead to unauthorized access, data breaches, and further exploitation of compromised accounts, posing a significant risk to the organization's security posture.

1`okta` eventType = security.threat.detected 
2| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city 
3| stats count min(_time) as firstTime max(_time) as lastTime by app src_ip signature eventType displayMessage client.device city state country user_agent outcome.reason outcome.result severity 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `okta_threatinsight_threat_detected_filter`

Data Source

Name Platform Sourcetype Source
Okta N/A 'OktaIM2:log' 'Okta'

Macros Used

Name Value
okta eventtype=okta_log OR sourcetype = "OktaIM2:log"
okta_threatinsight_threat_detected_filter search *
okta_threatinsight_threat_detected_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1078 Valid Accounts Defense Evasion
T1078.004 Cloud Accounts Initial Access
Delivery
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).

Known False Positives

False positives may occur. It is recommended to fine-tune Okta settings and the analytic to ensure high fidelity. Adjust the risk score as necessary.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

The following $src_ip$ has been identified as a threat by Okta ThreatInsight. Investigate further to determine if this was authorized.

Risk Object Risk Object Type Risk Score Threat Objects
app system 25 src_ip

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset Okta OktaIM2:log
Integration ✅ Passing Dataset Okta OktaIM2:log

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5