AnalysisType: rule
Description: "All MFA factors have been reset for a user."
DisplayName: "Okta User MFA Reset All"
Enabled: true
Filename: okta_user_mfa_reset_all.py
Reference: https://help.okta.com/en-us/content/topics/security/mfa/mfa-reset-users.htm#:~:text=the%20Admin%20Console%3A-,In%20the%20Admin%20Console%2C%20go%20to%20DirectoryPeople.,Selected%20Factors%20or%20Reset%20All
Severity: Low
Tests:
- ExpectedResult: true
Log:
actor:
alternateId: homer.simpson@duff.com
displayName: Homer Simpson
id: 00abc123
type: User
authenticationcontext:
authenticationStep: 0
externalSessionId: 100-abc-9999
client:
device: Computer
geographicalContext:
city: Springfield
country: United States
geolocation:
lat: 20
lon: -25
postalCode: "12345"
state: Ohio
ipAddress: 1.3.2.4
userAgent:
browser: CHROME
os: Mac OS X
rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
zone: "null"
debugcontext:
debugData:
requestId: AbCdEf12G
requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
displaymessage: Reset all factors for user
eventtype: user.mfa.factor.reset_all
legacyeventtype: core.user.factor.reset_all
outcome:
result: SUCCESS
published: "2022-06-22 18:18:29.015"
request:
ipChain:
- geographicalContext:
city: Springfield
country: United States
geolocation:
lat: 20
lon: -25
postalCode: "12345"
state: Ohio
ip: 1.3.2.4
version: V4
securitycontext:
asNumber: 701
asOrg: verizon
domain: verizon.net
isProxy: false
isp: verizon
severity: INFO
target:
- alternateId: peter.griffin@company.com
displayName: Peter Griffin
id: 0002222AAAA
type: User
transaction:
detail: {}
id: ABcDeFgG
type: WEB
uuid: AbC-123-XyZ
version: "0"
Name: Reset All Event
- ExpectedResult: false
Log:
actor:
alternateId: homer.simpson@duff.com
displayName: Homer Simpson
id: 00abc456
type: User
authenticationcontext:
authenticationStep: 0
externalSessionId: abc12345
client:
device: Unknown
ipAddress: 1.2.3.4
userAgent:
browser: UNKNOWN
os: Unknown
rawUserAgent: Chrome
zone: "null"
debugcontext:
debugData: {}
eventtype: application.integration.rate_limit_exceeded
legacyeventtype: app.api.error.rate.limit.exceeded
outcome:
result: SUCCESS
published: "2022-06-10 17:19:58.423"
request: {}
securitycontext: {}
severity: INFO
target:
- alternateId: "App "
displayName: App
id: "12345"
type: AppInstance
transaction:
detail: {}
id: sdfg
type: JOB
uuid: aaa-bb-ccc
version: "0"
Name: Other Event
DedupPeriodMinutes: 60
LogTypes:
- Okta.SystemLog
RuleID: "Okta.User.MFA.Reset.All"
Threshold: 1
# ------ paired body: okta_user_mfa_reset_all.py ------
from panther_okta_helpers import okta_alert_context
def rule(event):
return event.get("eventtype") == "user.mfa.factor.reset_all"
def title(event):
return (
"Okta: All MFA factors were reset for "
f"[{event.get('target',[{}])[0].get('alternateId', '<id-not-found>')}] "
f"by [{event.get('actor',{}).get('alternateId','<id-not-found>')}]"
)
def alert_context(event):
return okta_alert_context(event)