Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
MFA operations such as deactivation, update, reset, and bypass attempts can indicate account compromise or adversary attempts to weaken authentication controls.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Okta Single Sign-On |
| ID | 18667b4a-18e5-4982-ba75-92ace62bc79c |
| Tactics | DefenseEvasion, CredentialAccess |
| Techniques | T1556, T1556.006 |
| Required Connectors | OktaSSO, OktaSSOv2 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
OktaV2_CL |
? | ✓ | ? |
Okta_CL 🔶 |
✓ | ✓ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊