Analytics BIOC
Informational
✕
User added a new device to Okta Verify instance
The user has successfully registered a new device with the Okta Verify application.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Okta Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098) Valid Accounts (T1078)
Detector tags: Okta Audit Analytics
Attacker's goals:
Attackers may exploit the device registration process in Okta by registering unauthorized devices, thereby gaining access to sensitive resources and user accounts within an organization.
Investigative actions:
Reach out to the user responsible for the device registration to confirm its legitimacy. Examine the user's actions preceding and following the activation of the alert. Assess the reputation of the IP address along with that of the Autonomous System Number (ASN). Make sure the IP address is not showing any abnormal activity. Monitor the activity from the new registered device and ensure that it matches the user's normal activity.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Suspicious device enrollment to Okta Low (parent: Informational)