Okta ThreatInsight Suspected Password Spray Attack
This rule detects suspected password spraying attacks identified by Okta's ThreatInsight. It specifically looks for Okta security events categorized as 'Password Spray' and can additionally increase the risk score if the originating IP address is marked as suspicious by Okta ThreatInsight or if the login attempt originates from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
YARA-L
