Device Registration from Malicious IP

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This rule identifies successful Okta device registration events that originate from IP addresses also observed by Okta ThreatInsight as malicious or suspicious.

Attribute	Value
Type	Analytic Rule
Solution	Okta Single Sign-On
ID	e36c6bd6-f86a-4282-93a5-b4a1b48dd849
Severity	High
Status	Available
Kind	Scheduled
Tactics	Persistence
Techniques	T1098.005
Required Connectors	OktaSSO, OktaSSOv2
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
OktaV2_CL	?	✓	?
Okta_CL 🔶	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Okta Single Sign-On