You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
pre trained Deep Learning models for ESCU - Support for DSDL Version 5.1.1 #2939
@josehelps
Hello Team, can you help me with this OKAT ESCU ALERT: Okta Successful Single Factor Authentication.
index=okta action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
| stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method) by src_ip user action
| security_content_ctime(firstTime)
| security_content_ctime(lastTime)
| search targets !="Okta Verify"
| okta_successful_single_factor_authentication_filter
The query should be doing: identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used.
But it is doing the contrary in our environment, it is showing events where Okta Verify" is used, accounts with Multi-Factor Authentication (MFA) enabled...
MLTK detections will be deprecated in v5.24.0 - See #3922
Reasoning is - Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).
Activity
josehelps commentedon Jan 24, 2024
Hey @atgithub11 evaluating this request, will come back to you with an answer hopefully in the next 2 weeks. Thank you for raising.
AmeManneh commentedon Nov 26, 2024
@josehelps
Hello Team, can you help me with this OKAT ESCU ALERT: Okta Successful Single Factor Authentication.
index=okta action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
| stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method) by src_ip user action
|
security_content_ctime(firstTime)|
security_content_ctime(lastTime)| search targets !="Okta Verify"
|
okta_successful_single_factor_authentication_filterThe query should be doing: identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used.
But it is doing the contrary in our environment, it is showing events where Okta Verify" is used, accounts with Multi-Factor Authentication (MFA) enabled...
nasbench commentedon Mar 18, 2026
MLTK detections will be deprecated in v5.24.0 - See #3922
Reasoning is -
Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).Hence, I will be closing this issue as complete.