Okta New Behaviors Acessing Admin Console

Description

New Behaviors Observed while Accessing Okta Admin Console. A user attempted to access the Okta Admin Console from a new device with a new IP.

Query · python

import json

from panther_base_helpers import deep_get
from panther_okta_helpers import okta_alert_context


def rule(event):
    if event.get("eventtype") != "policy.evaluate_sign_on":
        return False

    if "Okta Admin Console" not in event.deep_walk("target", "displayName", default=""):
        return False

    behaviors = event.deep_get("debugContext", "debugData", "behaviors")
    if behaviors:
        return "New Device=POSITIVE" in behaviors and "New IP=POSITIVE" in behaviors

    log_only_security_data = event.deep_get("debugContext", "debugData", "logOnlySecurityData")
    if isinstance(log_only_security_data, str):
        log_only_security_data = json.loads(log_only_security_data)
    return (
        deep_get(log_only_security_data, "behaviors", "New Device") == "POSITIVE"
        and deep_get(log_only_security_data, "behaviors", "New IP") == "POSITIVE"
    )


def title(event):
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"accessed Okta Admin Console using new behaviors: "
        f"New IP: {event.deep_get('client', 'ipAddress', default='<ipAddress-not-found>')} "
        f"New Device: {event.deep_get('device', 'name', default='<deviceName-not-found>')}"
    )


def alert_context(event):
    return okta_alert_context(event)

Analyst notes

Configure Authentication Policies (Application Sign-on Policies) for access to privileged applications, including the Admin Console, to require re-authentication “at every sign-in”. Turn on and test New Device and Suspicious Activity end-user notifications.

Raw source Okta New Behaviors Acessing Admin Console · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: okta_new_behavior_accessing_admin_console.py
RuleID: "Okta.New.Behavior.Accessing.Admin.Console"
DisplayName: "Okta New Behaviors Acessing Admin Console"
Enabled: true
LogTypes:
  - Okta.SystemLog
Reports:
  MITRE ATT&CK:
    - TA0001:T1078.004 # Valid Accounts: Cloud Accounts
Severity: High
Description: >
  New Behaviors Observed while Accessing Okta Admin Console.
  A user attempted to access the Okta Admin Console from a new device with a new IP.
Runbook: >
  Configure Authentication Policies (Application Sign-on Policies) for access to privileged applications, including the Admin Console, to require re-authentication “at every sign-in”.
  Turn on and test New Device and Suspicious Activity end-user notifications.
Reference: >
  https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: New Behavior Accessing Admin Console (behavior)
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                behaviors:
                  [
                    New Geo-Location=NEGATIVE,
                    New Device=POSITIVE,
                    New IP=POSITIVE,
                    New State=NEGATIVE,
                    New Country=NEGATIVE,
                    Velocity=NEGATIVE,
                    New City=NEGATIVE,
                  ] }, },
        displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
              result: CHALLENGE },
        published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                        country: United States,
                        geolocation:
                          { lat: 20,
                            lon: -25 },
                        postalCode: "12345",
                        state: Ohio,
                        ip: 1.3.2.4,
                        version: V4 }, } ] },
        securitycontext:
          { asNumber: 701,
            asOrg: verizon,
            domain: verizon.net,
            isProxy: false,
            isp: verizon },
        severity: INFO,
        target:
          [ { alternateId: Okta Admin Console,
              displayName: Okta Admin Console,
              type: AppInstance },
            { alternateId: peter.griffin@company.com,
              displayName: Peter Griffin,
              id: 0002222AAAA,
              type: User }, ],
        transaction:
          { detail: { },
            id: ABcDeFgG,
            type: WEB },
      uuid: AbC-123-XyZ,
        version: "0" }
  - Name: New Behavior Accessing Admin Console (logSecurityDataOnly)
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                logOnlySecurityData:
                  {
                    "risk": { "level": "LOW" },
                    "behaviors":
                      {
                        "New Geo-Location": "NEGATIVE",
                        "New Device": "POSITIVE",
                        "New IP": "POSITIVE",
                        "New State": "NEGATIVE",
                        "New Country": "NEGATIVE",
                        "Velocity": "NEGATIVE",
                        "New City": "NEGATIVE",
                      },
                  } } },
        displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
              result: CHALLENGE },
        published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                        country: United States,
                        geolocation:
                          { lat: 20,
                            lon: -25 },
                        postalCode: "12345",
                        state: Ohio,
                        ip: 1.3.2.4,
                        version: V4 } } ] },
        securitycontext:
          { asNumber: 701,
            asOrg: verizon,
            domain: verizon.net,
            isProxy: false,
            isp: verizon },
        severity: INFO,
          target:
            [ { alternateId: Okta Admin Console,
                displayName: Okta Admin Console,
                type: AppInstance },
              { alternateId: peter.griffin@company.com,
                displayName: Peter Griffin,
                id: 0002222AAAA,
                type: User } ],
        transaction:
          { detail: { },
            id: ABcDeFgG,
            type: WEB },
        uuid: AbC-123-XyZ,
          version: "0" }
  - Name: Not New Behavior
    ExpectedResult: false
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
              displayName: Homer Simpson,
              id: 00abc123,
              type: User },
          authenticationcontext:
            { authenticationStep: 0,
                externalSessionId: 100-abc-9999 },
          client:
            { device: Computer,
                geographicalContext:
                  { city: Springfield,
                      country: United States,
                      geolocation:
                        { lat: 20,
                            lon: -25 },
                      postalCode: "12345",
                      state: Ohio },
                ipAddress: 1.3.2.4,
                userAgent:
                  { browser: CHROME,
                      os: Mac OS X,
                      rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
              zone: "null" },
          debugcontext:
            { debugData:
                { requestId: AbCdEf12G,
                    requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                    url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                    logOnlySecurityData:
                      {
                        "risk": { "level": "LOW" },
                        "behaviors":
                          {
                            "New Geo-Location": "NEGATIVE",
                            "New Device": "NEGATIVE",
                            "New IP": "NEGATIVE",
                            "New State": "NEGATIVE",
                            "New Country": "NEGATIVE",
                            "Velocity": "NEGATIVE",
                            "New City": "NEGATIVE",
                          },
                      } } },
          displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
                result: CHALLENGE },
          published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                          country: United States,
                          geolocation:
                            { lat: 20,
                                lon: -25 },
                          postalCode: "12345",
                          state: Ohio,
                          ip: 1.3.2.4,
                          version: V4 } } ] },
          securitycontext:
            { asNumber: 701,
                asOrg: verizon,
                domain: verizon.net,
                isProxy: false,
                isp: verizon },
          severity: INFO,
          target:
            [ { alternateId: Okta Admin Console,
                  displayName: Okta Admin Console,
                  type: AppInstance },
              { alternateId: peter.griffin@company.com,
                  displayName: Peter Griffin,
                  id: 0002222AAAA,
                  type: User } ],
          transaction:
            { detail: { },
                id: ABcDeFgG,
                type: WEB },
          uuid: AbC-123-XyZ,
          version: "0" }
  - Name: New Behavior Accessing Admin Console (logSecurityDataOnly) - not jsonified string
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                logOnlySecurityData: "{\"risk\":{\"level\":\"LOW\"},\"behaviors\":{\"New Geo-Location\":\"NEGATIVE\",\"New Device\":\"POSITIVE\",\"New IP\":\"POSITIVE\",\"New State\":\"NEGATIVE\",\"New Country\":\"NEGATIVE\",\"Velocity\":\"NEGATIVE\",\"New City\":\"NEGATIVE\"}}" }},
            displaymessage: Evaluation of sign-on policy,
            eventtype: policy.evaluate_sign_on,
            outcome:
              { reason: Sign-on policy evaluation resulted in CHALLENGE,
                result: CHALLENGE },
            published: "2022-06-22 18:18:29.015",
            request:
              { ipChain:
                  [ { geographicalContext:
                        { city: Springfield,
                          country: United States,
                          geolocation:
                            { lat: 20,
                              lon: -25 },
                          postalCode: "12345",
                          state: Ohio,
                          ip: 1.3.2.4,
                          version: V4 } } ] },
            securitycontext:
              { asNumber: 701,
                asOrg: verizon,
                domain: verizon.net,
                isProxy: false,
                isp: verizon },
            severity: INFO,
            target:
              [ { alternateId: Okta Admin Console,
                  displayName: Okta Admin Console,
                  type: AppInstance },
                { alternateId: peter.griffin@company.com,
                  displayName: Peter Griffin,
                  id: 0002222AAAA,
                  type: User } ],
            transaction:
              { detail: { },
                id: ABcDeFgG,
                type: WEB },
            uuid: AbC-123-XyZ,
            version: "0" }


# ------ paired body: okta_new_behavior_accessing_admin_console.py ------

import json

from panther_base_helpers import deep_get
from panther_okta_helpers import okta_alert_context


def rule(event):
    if event.get("eventtype") != "policy.evaluate_sign_on":
        return False

    if "Okta Admin Console" not in event.deep_walk("target", "displayName", default=""):
        return False

    behaviors = event.deep_get("debugContext", "debugData", "behaviors")
    if behaviors:
        return "New Device=POSITIVE" in behaviors and "New IP=POSITIVE" in behaviors

    log_only_security_data = event.deep_get("debugContext", "debugData", "logOnlySecurityData")
    if isinstance(log_only_security_data, str):
        log_only_security_data = json.loads(log_only_security_data)
    return (
        deep_get(log_only_security_data, "behaviors", "New Device") == "POSITIVE"
        and deep_get(log_only_security_data, "behaviors", "New IP") == "POSITIVE"
    )


def title(event):
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"accessed Okta Admin Console using new behaviors: "
        f"New IP: {event.deep_get('client', 'ipAddress', default='<ipAddress-not-found>')} "
        f"New Device: {event.deep_get('device', 'name', default='<deviceName-not-found>')}"
    )


def alert_context(event):
    return okta_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.