fixed verbiage

Author: terrancedejesus

rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml

@@ -6,9 +6,9 @@ updated_date = "2025/10/22"
 [rule]
 author = ["Elastic"]
 description = """
-Identifies when a single Okta device trust hash (dt_hash) is associated with multiple operating system types. This is
-highly anomalous because a device trust token is tied to a specific device and its operating system. This alert strongly
-indicates that an attacker has stolen a device trust token and is using it to impersonate a legitimate user from a
+Identifies when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is
+highly anomalous because a device token token is tied to a specific device and its operating system. This alert strongly
+indicates that an attacker has stolen a device token token and is using it to impersonate a legitimate user from a
 different machine.
 """
 false_positives = [
@@ -25,7 +25,7 @@ note = """## Triage and analysis
 
 ### Investigating Okta Multiple OS Names Detected for a Single DT Hash
 
-This rule detects when a single Okta device trust hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device trust token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device trust token and is using it to impersonate a legitimate user from a different machine.
+This rule detects when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device token token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device token token and is using it to impersonate a legitimate user from a different machine.
 
 ### Possible investigation steps
 - Review the `okta.debug_context.debug_data.dt_hash` field to identify the specific device
@@ -47,8 +47,8 @@ same dt_hash. This will help identify the nature of the anomaly.
 - If compromise is confirmed, reset the user's credentials and enforce multi-factor authentication (MFA)
 - Revoke any active sessions associated with the compromised account to prevent further unauthorized access.
 - Review and monitor the affected dt_hash for any further suspicious activity.
-- Educate users about the importance of device security and the risks associated with device trust tokens.
-- Implement additional monitoring for device trust tokens and consider using conditional access policies to restrict access based on device compliance status.
+- Educate users about the importance of device security and the risks associated with device token tokens.
+- Implement additional monitoring for device token tokens and consider using conditional access policies to restrict access based on device compliance status.
 """
 risk_score = 73
 rule_id = "fb3ca230-af4e-11f0-900d-f661ea17fbcc"