Skip to content

Commit

Permalink
Update User Session Impersonation(Okta)
Browse files Browse the repository at this point in the history
  • Loading branch information
praveenthepro authored Dec 29, 2023
1 parent f4c9f92 commit 6d044a8
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ relevantTechniques:
- T1098
query: |
// Filter for security events involving Okta user session impersonation initiation with successful outcomes
Okta_CL
OktaSSO
| where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array
Expand Down

0 comments on commit 6d044a8

Please sign in to comment.