Update User Session Impersonation(Okta)

Azure · Dec 29, 2023 · 4cfc7f9 · 4cfc7f9
1 parent 6d044a8
commit 4cfc7f9
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta) b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta)
@@ -20,8 +20,7 @@ tactics:
 relevantTechniques:
   - T1098
 query: |
-  // Filter for security events involving Okta user session impersonation initiation with successful outcomes
-  OktaSSO
+  Okta_CL
   | where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
   // Expand the JSON array in 'target_s' field to extract detailed information about the event
   | mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array