Okta User Rejected Multiple Push Notifications

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•114

Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window. This behavior can indicate an attacker attempting to gain access to an account by repeatedly sending MFA push notifications, hoping the user will eventually accept one (MFA fatigue).