Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0001 ✕ technique: T1199 ✕

Download CSV Show ATT&CK heatmap
  • Okta User Session Impersonation Informational Identity Threat Module, SaaS Threat Detection 1 variation

    A user has initiated a session impersonation in Okta.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Trusted Relationship (T1199)
    Required data: Okta Audit Log
    Detector tags: Okta Audit Analytics
    Attacker's goals: An attacker's goal is to gain unauthorized access to sensitive information or perform malicious actions on behalf of the impersonated user.
    Investigative actions: Ensure the user is authorized to impersonate a user session. Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.

    Variations

    Okta User Session Impersonation with suspicious characteristics

    Low overridden

    A user has initiated a session impersonation with suspicious characteristics in Okta. overridden