Posts tagged: #incident-response

Why Okta identity detections misfire on corporate VPNs, mobile networks and helpdesk work, what the analyzer cannot see, and how to verify each finding.

A fictional Okta intrusion read event by event: helpdesk reset, attacker factor, Super Admin grant, rogue IdP and AWS access, with the analyzer's findings.

Detect password spraying, brute force and credential stuffing against Okta: failure patterns per IP and user, ThreatInsight events, and the success to hunt.

Detect Okta session hijacking in the System Log: one externalSessionId used from several ASNs or browsers, roaming events, and ruling out VPN and mobile noise.

How helpdesk social engineering turns into an Okta MFA reset and account takeover, the reset-then-enroll sequence in the logs, and how to tell it from support.

Detect MFA fatigue (push bombing) in the Okta System Log: the Classic and Identity Engine eventTypes, a workable threshold, false positives, and what to fix.

The Okta System Log eventTypes that matter in an incident, grouped by attack stage, with the fields to read and the Classic vs Identity Engine differences.

Analyze an Okta System Log export in your browser: load the files, read the verdict and findings, pivot on users, IPs and sessions, and export the timeline.

Export the Okta System Log for an investigation: Admin Console CSV, /api/v1/logs with correct pagination, Log Streaming, SIEM exports and the traps to avoid.

How to investigate a suspected Okta compromise from the System Log: scope, the eventTypes that matter, the attack chain step by step, and what to contain first.