Okta User MFA Factor Suspend

Description

Suspend factor or authenticator enrollment method for user.

Query · python

from panther_okta_helpers import okta_alert_context


def rule(event):
    return (
        event.get("eventtype") == "user.mfa.factor.suspend"
        and event.deep_get("outcome", "result") == "SUCCESS"
    )


def title(event):
    return (
        "Okta: Authentication Factor for "
        f"[{event.get('target',[{}])[0].get('alternateId', '<id-not-found>')}] "
        f"has been suspended."
    )


def alert_context(event):
    return okta_alert_context(event)
Raw source Okta User MFA Factor Suspend · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: Suspend factor or authenticator enrollment method for user.
DisplayName: "Okta User MFA Factor Suspend"
Enabled: true
Filename: okta_user_mfa_factor_suspend.py
Reference: https://help.okta.com/en-us/content/topics/security/mfa/mfa-factors.htm
Severity: High
Tests:
  - ExpectedResult: true
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Suspend factor for user
      eventtype: user.mfa.factor.suspend
      outcome:
        reason: User suspended SIGNED_NONCE factor
        result: SUCCESS
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: Suspend Event
  - ExpectedResult: false
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Reset all factors for user
      eventtype: user.mfa.factor.reset_all
      legacyeventtype: core.user.factor.reset_all
      outcome:
        result: SUCCESS
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: Other Event
DedupPeriodMinutes: 60
LogTypes:
  - Okta.SystemLog
RuleID: "Okta.User.MFA.Factor.Suspend"
Threshold: 1


# ------ paired body: okta_user_mfa_factor_suspend.py ------

from panther_okta_helpers import okta_alert_context


def rule(event):
    return (
        event.get("eventtype") == "user.mfa.factor.suspend"
        and event.deep_get("outcome", "result") == "SUCCESS"
    )


def title(event):
    return (
        "Okta: Authentication Factor for "
        f"[{event.get('target',[{}])[0].get('alternateId', '<id-not-found>')}] "
        f"has been suspended."
    )


def alert_context(event):
    return okta_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.