Okta FastPass reported phishing attack suspected

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-01-27

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566)
Severity	Low

Okta FastPass authentication reported a phishing attack suspected.

An attacker might attempt to compromise Okta accounts to gain initial access to the organization, sensitive assets or data.

Examine Okta alerts and search for signs of compromise to evaluate the potential risk.
Examine email logs and headers to understand how the phishing email bypassed email security filters.
Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available.
Review recent login attempts, session details, and activity logs in OKTA for anomalies.
Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign.
Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.