Okta Credential Stuffing / Password Spray
This rule detects potential credential stuffing or password spraying attacks against Okta by monitoring for a high volume of failed primary authentication attempts from a single source IP address or ASN within a one-hour window. It also incorporates corroborating evidence such as account lockouts, Okta ThreatInsight detections, and blocked requests. The rule surfaces both failed attempts and successful logins that might indicate a compromised account.
Cortex XDR
