Okta has unveiled the open source availability of threat detection rules for the customers of its Auth0 identity and access management platform, BleepingComputer reports.
Introducing the Customer Detection Catalog would allow Auth0 users, who were previously dependent on their proprietary detection rules, to better determine attempted intrusions, account takeovers, token exfiltration, and malicious admin accounts, according to Okta, which noted the inclusion of Sigma rules within the public GitHub repository. After downloading the catalog through the GitHub repository, users are tasked to install a Sigma converted and import converted queries then configured for Auth0 event logs before executing the rules against historical logs and launching validated detections. "The catalog provides a growing collection of pre-built queries, contributed by Okta personnel and the wider security community, that surface suspicious activities like anomalous user behavior, potential account takeovers, and misconfigurations," said Okta.
Introducing the Customer Detection Catalog would allow Auth0 users, who were previously dependent on their proprietary detection rules, to better determine attempted intrusions, account takeovers, token exfiltration, and malicious admin accounts, according to Okta, which noted the inclusion of Sigma rules within the public GitHub repository. After downloading the catalog through the GitHub repository, users are tasked to install a Sigma converted and import converted queries then configured for Auth0 event logs before executing the rules against historical logs and launching validated detections. "The catalog provides a growing collection of pre-built queries, contributed by Okta personnel and the wider security community, that surface suspicious activities like anomalous user behavior, potential account takeovers, and misconfigurations," said Okta.
