Multiple Okta MFA requests sent to a user

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-06-18

Activation Period	14 Days
Training Period	30 Days
Test Period	30 Minutes
Deduplication Period	1 Day
Required Data	Requires: Okta
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586) Multi-Factor Authentication Request Generation (T1621)
Severity	Informational

Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.

An attacker is attempting to gain access to an account secured with MFA.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.

An attacker is attempting to gain access to an account secured with MFA.