Okta ThreatInsight Login Failure with High Unknown users

Name:Okta ThreatInsight Login Failure with High Unknown users
id:632663b0-4562-4aad-abe9-9f621a049738
version:5
date:2025-02-10
author:Okta, Inc, Michael Haag, Splunk
status:deprecated
type:TTP
Description:**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas ThreatInsight to identify Login failures with high unknown users count and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.
Data_source:

search:`okta` eventType="security.threat.detected" AND outcome.reason="Login failures with high unknown users count*"
| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) by user eventType client.userAgent.rawUserAgent client.userAgent.browser outcome.reason
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `okta_threatinsight_login_failure_with_high_unknown_users_filter`

how_to_implement:This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
known_false_positives:Fidelity of this is high as it is Okta ThreatInsight. Filter and modify as needed.
References:
  -https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
drilldown_searches:
  :
analytic_story:['Suspicious Okta Activity']

asset_type:Infrastructure

mitre_attack_id:['T1078.001', 'T1110.004']

product:None

category:None

security_domain:access

tags:
  analytic_story:
    - 'Suspicious Okta Activity'
  asset_type:Infrastructure
  mitre_attack_id:
    - 'T1078.001'
    - 'T1110.004'
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  security_domain:access

tests:
  :
manual_test:None