Possible Okta DoS Attack

 1[metadata]
 2creation_date = "2020/05/21"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/12/09"
 6min_stack_version = "8.15.0"
 7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an
13organization's business operations by performing a DoS attack against its Okta service.
14"""
15index = ["filebeat-*", "logs-okta*"]
16language = "kuery"
17license = "Elastic License v2"
18name = "Possible Okta DoS Attack"
19note = """## Setup
20
21The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
22references = [
23    "https://developer.okta.com/docs/reference/api/system-log/",
24    "https://developer.okta.com/docs/reference/api/event-types/",
25    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
26    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
27    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
28]
29risk_score = 47
30rule_id = "e6e3ecff-03dd-48ec-acbd-54a04de10c68"
31severity = "medium"
32tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Impact"]
33timestamp_override = "event.ingested"
34type = "query"
35
36query = '''
37event.dataset:okta.system and event.action:(application.integration.rate_limit_exceeded or system.org.rate_limit.warning or system.org.rate_limit.violation or core.concurrency.org.limit.violation)
38'''
39
40
41[[rule.threat]]
42framework = "MITRE ATT&CK"
43[[rule.threat.technique]]
44id = "T1498"
45name = "Network Denial of Service"
46reference = "https://attack.mitre.org/techniques/T1498/"
47
48[[rule.threat.technique]]
49id = "T1499"
50name = "Endpoint Denial of Service"
51reference = "https://attack.mitre.org/techniques/T1499/"
52
53
54[rule.threat.tactic]
55id = "TA0040"
56name = "Impact"
57reference = "https://attack.mitre.org/tactics/TA0040/"

References

• System Log | Okta Developer

  Secure, scalable, and highly available authentication and user management for any app.

  
  Read More

• Event Types | Okta Developer

  Secure, scalable, and highly available authentication and user management for any app.

  
  Read More

• Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs

  

  Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.

  
  Read More

• Monitoring Okta threats with Elastic Security — Elastic Security Labs

  

  This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.

  
  Read More

• Starter guide to understanding Okta — Elastic Security Labs

  

  This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.

  
  Read More

Related rules

• Attempt to Deactivate an Okta Application
• Attempt to Delete an Okta Application
• Attempt to Modify an Okta Application
• Attempt to Revoke Okta API Token
• Administrator Privileges Assigned to an Okta Group