Okta ThreatInsight Login Failure with High Unknown Users
This rule detects multiple login failures from the same IP address targeting unknown users, as identified by Okta's ThreatInsight. It specifically looks for Okta events categorized as 'USER_UNCATEGORIZED' and 'security.threat.detected' with a summary indicating 'Login failures with high unknown users count'. The rule also incorporates risk scoring based on whether the IP address is deemed suspicious by Okta ThreatInsight and if the login attempts originate from certain high-risk countries.
YARA-L
