Skip to content

Commit 081fba0

Browse files
Update rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml
Co-authored-by: Isai <[email protected]>
1 parent 909f308 commit 081fba0

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ note = """## Triage and analysis
2626
2727
### Investigating Okta Multiple OS Names Detected for a Single DT Hash
2828
29-
This rule detects when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device token token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device token token and is using it to impersonate a legitimate user from a different machine.
29+
This rule detects when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device token token and is using it to impersonate a legitimate user from a different machine.
3030
3131
### Possible investigation steps
3232
- Review the `okta.debug_context.debug_data.dt_hash` field to identify the specific device

0 commit comments

Comments
 (0)