Okta Login Without Push Marker

Query · python

# configure this Push marker based on your environment
PUSH_MARKER = "PS_mxzqarw"


def rule(event):
    return not event.deep_get("client", "userAgent", "rawUserAgent", default="").endswith(
        PUSH_MARKER
    )


def title(event):
    actor = event.deep_get("actor", "displayName")
    return f"{actor} logged in from device without expected Push marker"
Raw source Okta Login Without Push Marker · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: okta_login_without_push_marker.py
RuleID: "Okta.Login.Without.Push.Marker"
DisplayName: "Okta Login Without Push Marker"
Enabled: false
Tags:
  - Push Security
  - Configuration Required
LogTypes:
  - Okta.SystemLog
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Login with marker
    ExpectedResult: false
    Log:
      actor:
        alternateId: alice.beaver@company.com
        displayName: Alice Beaver
        id: 00u99ped55av2JpGs5d7
        type: User
      authenticationContext:
        authenticationStep: 0
        externalSessionId: trsxcsf59kYRG-GwAbWjw-PZA
      client:
        device: Unknown
        ipAddress: 11.22.33.44
        userAgent:
          browser: UNKNOWN
          os: Unknown
          rawUserAgent: Go-http-client/2.0 PS_mxzqarw
        zone: "null"
      debugContext:
        debugData:
          dtHash: 53dd1a7513e0256eb13b9a47bb07ed61e8ca3d35fbdc36c909567a21a65a2b19
          rateLimitBucketUuid: b192d91c-b242-36da-9332-d97a5579f865
          rateLimitScopeType: ORG
          rateLimitSecondsToReset: "6"
          requestId: 234cf34e0081e025e1fe14224464bbd6
          requestUri: /api/v1/logs
          threshold: "20"
          timeSpan: "1"
          timeUnit: MINUTES
          url: /api/v1/logs?since=2023-09-21T17%3A04%3A22Z&limit=1000&after=1714675441520_1
          userId: 00u99ped55av2JpGs5d7
          warningPercent: "60"
      displayMessage: Rate limit warning
      eventType: system.org.rate_limit.warning
      legacyEventType: core.framework.ratelimit.warning
      outcome:
        result: SUCCESS
      published: "2024-05-02 18:46:21.121000000"
      request:
        ipChain:
          - ip: 11.22.33.44
            version: V4
      securityContext: {}
      severity: WARN
      target:
        - id: /api/v1/logs
          type: URL Pattern
        - id: b192d91c-b242-36da-9332-d97a5579f865
          type: Bucket Uuid
      transaction:
        detail:
          requestApiTokenId: 00T1bjatrp6Nl1dOc5d7
        id: 234cf34e0081e025e1fe14224464bbd6
        type: WEB
      uuid: 44aeb388-08b4-11ef-9cec-73ffcb6f9fdd
      version: "0"
  - Name: Login without marker
    ExpectedResult: true
    Log:
      actor:
        alternateId: alice.beaver@company.com
        displayName: Alice Beaver
        id: 00u99ped55av2JpGs5d7
        type: User
      authenticationContext:
        authenticationStep: 0
        externalSessionId: trsxcsf59kYRG-GwAbWjw-PZA
      client:
        device: Unknown
        ipAddress: 11.22.33.44
        userAgent:
          browser: UNKNOWN
          os: Unknown
          rawUserAgent: Go-http-client/2.0
        zone: "null"
      debugContext:
        debugData:
          dtHash: 53dd1a7513e0256eb13b9a47bb07ed61e8ca3d35fbdc36c909567a21a65a2b19
          rateLimitBucketUuid: b192d91c-b242-36da-9332-d97a5579f865
          rateLimitScopeType: ORG
          rateLimitSecondsToReset: "6"
          requestId: 234cf34e0081e025e1fe14224464bbd6
          requestUri: /api/v1/logs
          threshold: "20"
          timeSpan: "1"
          timeUnit: MINUTES
          url: /api/v1/logs?since=2023-09-21T17%3A04%3A22Z&limit=1000&after=1714675441520_1
          userId: 00u99ped55av2JpGs5d7
          warningPercent: "60"
      displayMessage: Rate limit warning
      eventType: system.org.rate_limit.warning
      legacyEventType: core.framework.ratelimit.warning
      outcome:
        result: SUCCESS
      published: "2024-05-02 18:46:21.121000000"
      request:
        ipChain:
          - ip: 11.22.33.44
            version: V4
      securityContext: {}
      severity: WARN
      target:
        - id: /api/v1/logs
          type: URL Pattern
        - id: b192d91c-b242-36da-9332-d97a5579f865
          type: Bucket Uuid
      transaction:
        detail:
          requestApiTokenId: 00T1bjatrp6Nl1dOc5d7
        id: 234cf34e0081e025e1fe14224464bbd6
        type: WEB
      uuid: 44aeb388-08b4-11ef-9cec-73ffcb6f9fdd
      version: "0"


# ------ paired body: okta_login_without_push_marker.py ------

# configure this Push marker based on your environment
PUSH_MARKER = "PS_mxzqarw"


def rule(event):
    return not event.deep_get("client", "userAgent", "rawUserAgent", default="").endswith(
        PUSH_MARKER
    )


def title(event):
    actor = event.deep_get("actor", "displayName")
    return f"{actor} logged in from device without expected Push marker"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.