Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0001 ✕

Download CSV Show ATT&CK heatmap
  • Okta FastPass reported phishing attack suspected Low Identity Analytics 1 variation

    Okta FastPass authentication reported a phishing attack suspected.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing (T1566)
    Required data: Palo Alto Networks Firewall EAL Logs XDR Agent Palo Alto Networks Firewall threat Logs
    Attacker's goals: An attacker might attempt to compromise Okta accounts to gain initial access to the organization, sensitive assets or data.
    Investigative actions: Examine Okta alerts and search for signs of compromise to evaluate the potential risk. Examine email logs and headers to understand how the phishing email bypassed email security filters. Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available. Review recent login attempts, session details, and activity logs in OKTA for anomalies. Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign. Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.

    Variations

    Okta FastPass reported phishing attack suspected from a suspicious IP

    Medium overridden

    Okta FastPass authentication reported a phishing attack suspected. overridden