Elastic Security Detection Rules

Okta User Session Impersonation

Last updated 13 days ago on 2024-12-09
Created 3 years ago on 2022-03-22

About

A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.
Tags
Use Case: Identity and Access AuditTactic: Credential AccessData Source: Okta
Severity
high
Risk Score
73
MITRE ATT&CK™

Credential Access (TA0006)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
filebeat-*logs-okta*
Related Integrations

okta(opens in a new tab or window)

Query
event.dataset:okta.system and event.action:user.session.impersonation.initiate

Install detection rules in Elastic Security

Detect Okta User Session Impersonation in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).