Okta ThreatInsight Targeted Brute Force Attack Detection
This rule detects targeted brute-force attacks against an Okta organization. It specifically looks for events from Okta ThreatInsight where known malicious IPs are attempting to access a specific user account, indicated by multiple failed authentication attempts for the same user within a one-hour window. The rule leverages Okta's security.attack.start event type to identify these activities.
YARA-L
