Possible Okta DoS Attack

calendar Oct 24, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact  ·
Share on: linkedin copy

Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/05/21"
 3integration = ["okta"]
 4maturity = "production"
 5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
 6min_stack_version = "8.10.0"
 7updated_date = "2023/10/24"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an
13organization's business operations by performing a DoS attack against its Okta service.
14"""
15index = ["filebeat-*", "logs-okta*"]
16language = "kuery"
17license = "Elastic License v2"
18name = "Possible Okta DoS Attack"
19note = """## Setup
20
21The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
22references = [
23    "https://developer.okta.com/docs/reference/api/system-log/",
24    "https://developer.okta.com/docs/reference/api/event-types/",
25    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
26]
27risk_score = 47
28rule_id = "e6e3ecff-03dd-48ec-acbd-54a04de10c68"
29severity = "medium"
30tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Impact"]
31timestamp_override = "event.ingested"
32type = "query"
33
34query = '''
35event.dataset:okta.system and event.action:(application.integration.rate_limit_exceeded or system.org.rate_limit.warning or system.org.rate_limit.violation or core.concurrency.org.limit.violation)
36'''
37
38
39[[rule.threat]]
40framework = "MITRE ATT&CK"
41[[rule.threat.technique]]
42id = "T1498"
43name = "Network Denial of Service"
44reference = "https://attack.mitre.org/techniques/T1498/"
45
46[[rule.threat.technique]]
47id = "T1499"
48name = "Endpoint Denial of Service"
49reference = "https://attack.mitre.org/techniques/T1499/"
50
51
52[rule.threat.tactic]
53id = "TA0040"
54name = "Impact"
55reference = "https://attack.mitre.org/tactics/TA0040/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top