All Detections

Okta User Session Impersonation Grant

avatar
Danny Y@zendannyy
updated Dec 26, 202560141

This detects events in Okta where there is the eventType of "user.session.impersonation.grant". This grants access in the context of the user. This could be high privilege admin access.

Splunk (SPL)