Okta Reported Attack Suspected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Okta Audit Log
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Low

Description

Okta Threat Insight Reported Attack Suspected.

Attacker's Goals

An attacker might attempt to compromise Okta accounts to gain access to sensitive assets or data.

Investigative actions

• Examine Okta alerts and search for signs of compromise to evaluate the potential risk.