Skip to content

pre trained Deep Learning models for ESCU - Support for DSDL Version 5.1.1 #2939

Closed

Description

@atgithub11

https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU

At present, looks like use of these models is only supported on DSDL Version 5.0 with Golden Image CPU 5.0.0

Is there any possibility of supporting this on latest DSDL version 5.1.1 as well?

Activity

  1. self-assigned this
    on Jan 24, 2024
  2. josehelps commented on Jan 24, 2024

    @josehelps
    Contributor

    Hey @atgithub11 evaluating this request, will come back to you with an answer hopefully in the next 2 weeks. Thank you for raising.

  3. AmeManneh commented on Nov 26, 2024

    @AmeManneh

    @josehelps
    Hello Team, can you help me with this OKAT ESCU ALERT: Okta Successful Single Factor Authentication.

    index=okta action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
    | stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method) by src_ip user action
    | security_content_ctime(firstTime)
    | security_content_ctime(lastTime)
    | search targets !="Okta Verify"
    | okta_successful_single_factor_authentication_filter

    The query should be doing: identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used.

    But it is doing the contrary in our environment, it is showing events where Okta Verify" is used, accounts with Multi-Factor Authentication (MFA) enabled...

  4. added theissue type on Apr 9, 2025
  5. nasbench commented on Mar 18, 2026

    @nasbench
    Contributor

    MLTK detections will be deprecated in v5.24.0 - See #3922

    Reasoning is - Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).

    Hence, I will be closing this issue as complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions