Detection Rules Overview

Cloud

Container

AWS Credentials Searched For Inside A Container
Container Management Utility Run Inside A Container
File Made Executable via Chmod Inside A Container
File System Debugger Launched Inside a Container
Mount Launched Inside a Container
SSH Process Launched From Inside A Container
Sensitive Files Compression Inside A Container
Sensitive Keys Or Passwords Searched For Inside A Container
Suspicious Network Tool Launched Inside A Container
Unusual Interactive Process Launched in a Container

Endpoint

LLM

AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User
AWS Bedrock Detected Multiple Validation Exception Errors by a Single User
AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request
AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session
AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session
Azure OpenAI Insecure Output Handling
Potential Abuse of Resources by High Token Count and Large Response Sizes
Potential Azure OpenAI Model Theft
Potential Denial of Azure OpenAI ML Service
Unusual High Confidence Content Filter Blocks Detected
Unusual High Denied Sensitive Information Policy Blocks Detected
Unusual High Denied Topic Blocks Detected
Unusual High Word Policy Blocks Detected

Network

Machine Learning Detected DGA activity using a known SUNBURST DNS domain
Machine Learning Detected a DNS Request Predicted to be a DGA Domain
Machine Learning Detected a DNS Request With a High DGA Probability Score
Potential Network Scan Detected
Potential Network Sweep Detected
Potential SYN-Based Port Scan Detected
Statistical Model Detected C2 Beaconing Activity
Statistical Model Detected C2 Beaconing Activity with High Confidence

SaaS

Multiple Device Token Hashes for Single Okta Session
Successful Application SSO from Rare Unknown Client Device
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials

Unspecified

Abnormally Large DNS Response
Administrator Privileges Assigned to an Okta Group
Administrator Role Assigned to an Okta User
Adversary Behavior - Detected - Elastic Endgame
Agent Spoofing - Mismatched Agent ID
Agent Spoofing - Multiple Hosts Using Same Agent
Attempt to Create Okta API Token
Attempt to Deactivate an Okta Application
Attempt to Deactivate an Okta Network Zone
Attempt to Deactivate an Okta Policy
Attempt to Deactivate an Okta Policy Rule
Attempt to Delete an Okta Application
Attempt to Delete an Okta Network Zone
Attempt to Delete an Okta Policy
Attempt to Delete an Okta Policy Rule
Attempt to Modify an Okta Application
Attempt to Modify an Okta Network Zone
Attempt to Modify an Okta Policy
Attempt to Modify an Okta Policy Rule
Attempt to Reset MFA Factors for an Okta User Account
Attempt to Revoke Okta API Token
Attempted Bypass of Okta MFA
Attempts to Brute Force an Okta User Account
Behavior - Detected - Elastic Defend
Behavior - Prevented - Elastic Defend
Credential Dumping - Detected - Elastic Endgame
Credential Dumping - Prevented - Elastic Endgame
Credential Manipulation - Detected - Elastic Endgame
Credential Manipulation - Prevented - Elastic Endgame
CyberArk Privileged Access Security Error
CyberArk Privileged Access Security Recommended Monitor
DNS Tunneling
Decline in host-based traffic
Endpoint Security (Elastic Defend)
Enumeration of Kernel Modules via Proc
Exploit - Detected - Elastic Endgame
Exploit - Prevented - Elastic Endgame
External Alerts
First Occurrence of Okta User Session Started via Proxy
High Command Line Entropy Detected for Privileged Commands
High Mean of Process Arguments in an RDP Session
High Mean of RDP Session Duration
High Number of Okta Device Token Cookies Generated for Authentication
High Number of Okta User Password Reset or Unlock Attempts
High Variance in RDP Session Duration
Host Detected with Suspicious Windows Process(es)
Kubernetes Anonymous Request Authorized
Kubernetes Container Created with Excessive Linux Capabilities
Kubernetes Denied Service Account Request
Kubernetes Exposed Service Created With Type NodePort
Kubernetes Pod Created With HostIPC
Kubernetes Pod Created With HostNetwork
Kubernetes Pod Created With HostPID
Kubernetes Pod created with a Sensitive hostPath Volume
Kubernetes Privileged Pod Created
Kubernetes Suspicious Assignment of Controller Service Account
Kubernetes Suspicious Self-Subject Review
Kubernetes User Exec into Pod
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score
Malicious File - Detected - Elastic Defend
Malicious File - Prevented - Elastic Defend
Malware - Detected - Elastic Endgame
Malware - Prevented - Elastic Endgame
Memory Threat - Detected - Elastic Defend
Memory Threat - Prevented- Elastic Defend
Modification or Removal of an Okta Application Sign-On Policy
Multiple Alerts Involving a User
Multiple Alerts in Different ATT&CK Tactics on a Single Host
Multiple Okta Sessions Detected for a Single User
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
Multiple Okta User Authentication Events with Client Address
Multiple Okta User Authentication Events with Same Device Token Hash
My First Rule
Network Traffic to Rare Destination Country
New Okta Authentication Behavior Detected
New Okta Identity Provider (IdP) Added by Admin
Okta Brute Force or Password Spraying Attack
Okta FastPass Phishing Detection
Okta Sign-In Events via Third-Party IdP
Okta ThreatInsight Threat Suspected Promotion
Okta User Session Impersonation
Okta User Sessions Started from Different Geolocations
Permission Theft - Detected - Elastic Endgame
Permission Theft - Prevented - Elastic Endgame
Possible Okta DoS Attack
Potential DGA Activity
Potential Data Exfiltration Activity to an Unusual Destination Port
Potential Data Exfiltration Activity to an Unusual IP Address
Potential Data Exfiltration Activity to an Unusual ISO Code
Potential Data Exfiltration Activity to an Unusual Region
Potential Okta MFA Bombing via Push Notifications
Potentially Successful MFA Bombing via Push Notifications
Process Injection - Detected - Elastic Endgame
Process Injection - Prevented - Elastic Endgame
Ransomware - Detected - Elastic Defend
Ransomware - Detected - Elastic Endgame
Ransomware - Prevented - Elastic Defend
Ransomware - Prevented - Elastic Endgame
Rapid7 Threat Command CVEs Correlation
Rare User Logon
Spike in Bytes Sent to an External Device
Spike in Bytes Sent to an External Device via Airdrop
Spike in Failed Logon Events
Spike in Firewall Denies
Spike in Group Application Assignment Change Events
Spike in Group Lifecycle Change Events
Spike in Group Management Events
Spike in Group Membership Events
Spike in Group Privilege Change Events
Spike in Logon Events
Spike in Network Traffic
Spike in Network Traffic To a Country
Spike in Number of Connections Made from a Source IP
Spike in Number of Connections Made to a Destination IP
Spike in Number of Processes in an RDP Session
Spike in Privileged Command Execution by a User
Spike in Remote File Transfers
Spike in Special Logon Events
Spike in Special Privilege Use Events
Spike in Successful Logon Events from a Source IP
Spike in User Account Management Events
Spike in User Lifecycle Management Change Events
Spike in host-based traffic
Suspicious Activity Reported by Okta User
Suspicious Modprobe File Event
Suspicious Proc Pseudo File System Enumeration
Suspicious Sysctl File Event
Threat Intel Hash Indicator Match
Threat Intel IP Address Indicator Match
Threat Intel URL Indicator Match
Threat Intel Windows Registry Indicator Match
Unauthorized Access to an Okta Application
Unusual DNS Activity
Unusual Group Name Accessed by a User
Unusual Host Name for Okta Privileged Operations Detected
Unusual Host Name for Windows Privileged Operations Detected
Unusual Hour for a User to Logon
Unusual Login Activity
Unusual Network Destination Domain Name
Unusual Privilege Type assigned to a User
Unusual Process Detected for Privileged Commands by a User
Unusual Process Writing Data to an External Device
Unusual Region Name for Okta Privileged Operations Detected
Unusual Region Name for Windows Privileged Operations Detected
Unusual Remote File Directory
Unusual Remote File Extension
Unusual Remote File Size
Unusual Source IP for Okta Privileged Operations Detected
Unusual Source IP for Windows Privileged Operations Detected
Unusual Source IP for a User to Logon from
Unusual Spike in Concurrent Active Sessions by a User
Unusual Time or Day for an RDP Session
Unusual Web Request
Unusual Web User Agent
Web Application Suspicious Activity: POST Request Declined
Web Application Suspicious Activity: Unauthorized Method
Web Application Suspicious Activity: sqlmap User Agent
Zoom Meeting with no Passcode

The Search AI Company

ELK Stack

Elastic Cloud

Generative AI

Search

Security

Observability

By solution

Industries

Customer spotlight

Research

Build

Learn

Connect

Detection Rules Overview

Cloud

Container

Endpoint

LLM

Network

SaaS

Unspecified