Okta MFA Push Bombing / Fatigue Detection
This rule detects a burst of Okta Multi-Factor Authentication (MFA) push prompts to a single user within a short time window, indicating a potential MFA bombing or fatigue attack. It specifically looks for scenarios where at least 5 push notifications are sent, and at least one is approved, suggesting the user might have caved under pressure. The rule also enriches the data with client IP, geographical context, and proxy information to aid investigation.
Cortex XDR
