Okta Admin Activity Anomaly
Detects new administrative actions performed by an account, or actions performed on multiple targets simultaneously. Users will fail this check if there are 10 or more different targets within 10 minutes or less.
Adversaries may create/modify an account to maintain access to victim systems or to modify the configuration settings to evade defenses and/or escalate privileges.
Recommended Actions
Verify with the account the reason for the changes.
Most of the alerts will represent accounts/application lifecycle (join/leave/move) so it's important to check the context of the action.
Default Check Settings
Number of distinct targets: 10
Timeframe in minutes:10
Compatibility
Last updated
