Okta Authentication Failure Spike from Single Source IP
Detects high volumes of authentication failures within Okta, characterized by a single source IP address targeting a large number of distinct user accounts. This behavior is indicative of automated credential attacks, such as password spraying or credential stuffing, designed to discover valid credentials or exploit reused passwords while attempting to evade account lockout thresholds.
Cortex XDR
