new files for okta story

detections/okta_failed_sso_attempt.yml

@@ -0,0 +1,69 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: Detect failed Okta SSO events
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: Okta user $user$ attempted to access unauthorized app
+        rule_title: Okta user SSO attempt to unauthorized app
+      risk:
+        risk_object: user
+        risk_object_type:
+          - user
+        risk_score: 50
+      macros:
+        - okta_failed_sso_attempt_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log displayMessage="User attempted unauthorized access to app" | stats  min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`okta_failed_sso_attempt_filter`'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search looks for events that indicate a user attempted to access an app they did not have permissions to access. This could indicate attempts to access prohibited applications. Please leverage the `okta_failed_sso_attempt_filter` macro to filter out false positives
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 371a6545-2618-4032-ad84-93386b8698c5
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activities In Okta
+    type: splunk
+  - id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
+    name: Investigate Okta Activity by App
+    type: splunk
+known_false_positives: There may be a faulty config preventing legitmate users from accessing apps they should have access to. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta Failed SSO Attempts
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"

detections/okta_multiple_users_with_auth_failures_from_ip.yml

@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address.
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: src_ip
+        rule_description: Multiple Users Failing Authenticaiton From $src_ip$
+        rule_title: Multiple Okta Users With Authentication Failures From a Single IP
+      risk:
+        risk_object: system
+        risk_object_type:
+          - system
+        risk_score: 50
+      macros:
+        - okta_multiple_users_with_auth_failures_from_ip_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  search distinct_users > 5| `okta_multiple_users_with_auth_failures_from_ip_filter`'
+      suppress:
+        suppress_fields: src_ip
+        suppress_period: 86400s
+eli5: This search detects instances when there are more than 5 distinct users failing Okta logins due to invalid credentails from the same IP address. This may be indicative of attack techniques such as credential stuffing or password spraying, where an attacker attempts to login using common or found passwords and attempts to authenticate with them. 
+entities:
+  - src_ip
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 19cba45f-cad3-4032-8911-0c09e0444552
+investigations:
+  - id: 56aae066-d619-477c-93e3-3fb83b2d23c3
+    name: Investigate Okta Activity by IP Address
+    type: splunk
+known_false_positives: A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Multiple Okta Users With Invalid Credentails From The Same IP
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"

detections/okta_user_lockouts.yml

@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: Detect Okta user lockout events
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: User $user$ locked out of Okta - too many attempts
+        rule_title: Okta user lockout events
+      risk:
+        risk_object: user
+        risk_object_type:
+          - user
+        risk_score: 50
+      macros:
+        - okta_user_lockouts_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip |`okta_user_lockouts_filter`'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search detects when a user exceeds the maximum configured Okta login attempts and the account is subsequently locked out. This is often indicative of brtue force attempts against a user account. 
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 62b70968-a0a5-4724-8ac4-67871e6f544d
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activity In Okta
+    type: splunk
+known_false_positives: None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta Account Lockout Events
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"

detections/okta_user_logins_from_multiple_cities.yml

@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search detects logins from the same user from different states in a 24 hour period.
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: User $user$ logged into Okta from different cities
+        rule_title: Okta user login from different cities
+      risk:
+        risk_object: user
+        risk_object_type:
+          - system
+        risk_score: 50
+      macros:
+        - okta_user_logins_from_multiple_cities_filter       
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -24h@h
+        latest_time: -5m@m
+      search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`okta_user_logins_from_multiple_cities_filter`| search locations > 1'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search detects users logging in from multiple states in the last 24 hours. This can be indicative of an attacker using compromised credentials to log in to Okta. The efficacy of this search is highly dependant on the mobility of the users using Okta. It is particularly useful in situations where users should explicitly *not* be travelling, such as during the COVID-19 pandemic. 
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activity In Okta
+    type: splunk
+known_false_positives: Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta User Logins From Multiple Cities
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"

investigations/get_okta_activity_by_app.yml

@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events associated with a specific app
+entities:
+  - app
+how_to_implement: You must be ingesting Okta logs
+id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
+investigate:
+  splunk:
+    fields_required:
+      - app
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log app={app} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate Okta Activity by app
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'

investigations/get_okta_activity_by_ip.yml

@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events from a specific IP address.
+entities:
+  - src_ip
+how_to_implement: You must be ingesting Okta logs
+id: 56aae066-d619-477c-93e3-3fb83b2d23c3
+investigate:
+  splunk:
+    fields_required:
+      - user
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate Okta Activity by IP Address
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'

investigations/get_okta_user_activity.yml

@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events by a specific user
+entities:
+  - user
+how_to_implement: You must be ingesting Okta logs
+id: 24ff145d-4d16-420a-b047-480f2a51c403
+investigate:
+  splunk:
+    fields_required:
+      - user
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log user={user} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate User Activities In Okta
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'

macros/okta_failed_sso_attempt_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_failed_sso_attempt_filter

macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_multiple_users_with_auth_failures_from_ip_filter

macros/okta_user_lockouts_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_user_lockouts_filter

macros/okta_user_logins_from_multiple_cities_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_user_logins_from_multiple_cities_filter