Okta FastPass Phishing Detection

Title: Okta FastPass Phishing Detection
Status: test
Description:Detects when Okta FastPass prevents a known phishing site.
References:
  -https://sec.okta.com/fastpassphishingdetection
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://developer.okta.com/docs/reference/api/event-types/
Author: Austin Songer @austinsonger
Date: 2023-05-07
modified:2026-04-27
Tags:

• -'attack.initial-access'
• -'attack.t1566'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    outcome.reason: 'FastPass declined phishing attempt'
    outcome.result: 'FAILURE'
    eventType: 'user.authentication.auth_via_mfa'
  condition:selection
Falsepositives:
  -Unlikely
Level: high