Auth0 Guardian MFA push notifications rejected by user

Set up the auth0 integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects when multiple Auth0 Guardian multi-factor authentication (MFA) push notifications have been rejected by a user.

Strategy

This rule allows you to monitor Auth0 logs and detect when multiple Auth0 Guardian MFA push notifications have been rejected by a user. Attackers may attempt to bypass MFA mechanisms and gain access to accounts by generating MFA requests sent to users. Bombarding users with MFA push notifications may result in the user finally accepting the authentication request.

Triage and response

  1. Speak with the user {{@usr.id}} to understand the context of push rejections, if the push notifications were initiated by the user.
  2. If the user did not initate the push notifications:
    • Filter for @evt.name:multifactor_push_notification_sent and the specific @usr.id to highlight push notifications. Compare previous geo-locations, user-agents and IP addresses for the user to determine if this is abnormal activity.
    • If it is believed to be malicious activity then disable the user, invalidate any active sessions and rotate their credentials.
    • Begin your organization’s incident response process and investigate.
PREVIEWING: drodriguezhdez/add_public_docs_log_summarization