Duo MFA Push Fatigue Activity
Detects a suspicious burst of multi-factor authentication (MFA) push request denials (such as user cancellations or ignored requests) originating from a single user within a short time window. This behavior is indicative of MFA fatigue, where an attacker repeatedly triggers MFA requests in an attempt to annoy or trick the legitimate user into inadvertently approving a push notification.
Cortex XDR
