Okta device assignment

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	6 Hours
Deduplication Period	1 Day
Required Data	Requires: Okta Audit Log
Detection Modules	Identity Threat Module
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Initial Access (TA0001) Persistence (TA0003)
ATT&CK Technique	Valid Accounts (T1078)
Severity	Informational

A device was assigned as an Okta MFA device to a user.

For purposes of maintaining persistence, an attacker could potentially register his device with various accounts that have been compromised.

Confirm that the device assignments were intentionally made by the users and are legitimate.
Examine the IP address and assess its reputation.
Continue monitoring the accounts for any subsequent actions that may indicate suspicious behavior.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A single device is being used as an Okta MFA device by multiple users.

For purposes of maintaining persistence, an attacker could potentially register his device with various accounts that have been compromised.

Confirm that the device assignments were intentionally made by the users and are legitimate.
Examine the IP address and assess its reputation.
Continue monitoring the accounts for any subsequent actions that may indicate suspicious behavior.