New Device/Location sign-in along with critical operation

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query identifies users seen login from new geo location/country as well as a new device and performing critical operations.

Attribute	Value
Type	Analytic Rule
Solution	Okta Single Sign-On
ID	41e843a8-92e7-444d-8d72-638f1145d1e1
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	InitialAccess, Persistence
Techniques	T1078, T1556
Required Connectors	OktaSSO, OktaSSOv2
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
OktaV2_CL	?	✓	?
Okta_CL 🔶	?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Okta Single Sign-On