Okta Password Health Report Query
Detects all activities against the endpoint "/reports/password-health/*" which should only be accessed via OKTA Admin Console UI. Use this rule to hunt for potential suspicious requests. Correlate this event with "admin console" login and alert on requests without any corresponding admin console login
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
detection:
selection:
debugContext.debugData.requestUri|contains: '/reports/password-health/'
condition: selectionOKTA Admin Activites via Web Console UI.
This rule is recommended to be used for threat hunting, especially in the context of OKTA support incident in OCT-2023.
This rule can be used to hunt the activity against endpoints like /reports/password-health/async_csv_download_schedule?, which are typically used from Okta Admin Console UI only, without any corresponding admin console login. See reference
Tactics
Other