Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,731
Ready to search
Backends
17
Loaded from pysigma-node
pySigma Versions
10
Newest: 1.3.3
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Okta Admin Functions Access Through Proxy
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Conversion Output
Okta Admin Functions Access Through Proxy
Using Splunk · Default · pySigma 1.3.3
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion1.3.3
title: Okta Admin Functions Access Through Proxy
id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309
status: test
description: Detects access to Okta admin functions through proxy.
references:
- https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- https://dataconomy.com/2023/10/23/okta-data-breach/
- https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
author: Muhammad Faisal @faisalusuf
date: 2023-10-25
tags:
- attack.credential-access
logsource:
service: okta
product: okta
detection:
selection:
debugContext.debugData.requestUri|contains: 'admin'
securityContext.isProxy: 'true'
condition: selection
falsepositives:
- False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary
level: medium
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/identity/okta/okta_admin_activity_from_proxy_query.yml