Okta Password Health Report Access Detection
Detects access to the Okta password health report endpoint, which should only be accessed via the Okta Admin Console UI. This rule is intended for threat hunting to identify suspicious requests, especially when correlated with the absence of a corresponding admin console login. This activity was highlighted in the context of the Okta support incident in October 2023.
Sigma
