okta_mfa_password_reset_audit.yml

AnalysisType: scheduled_query
QueryName: Okta Investigate MFA and Password resets
Enabled: false
Description: >
  Investigate Password and MFA resets for the last 7 days 
AthenaQuery: > 
  SELECT p_event_time,actor.alternateId as actor_user,target[1].alternateId as target_user, eventType,client.ipAddress as ip_address
  FROM panther_logs.okta_systemlog
  WHERE eventType IN ('user.mfa.factor.reset_all', 'user.mfa.factor.deactivate', 'user.mfa.factor.suspend', 'user.account.reset_password', 'user.account.update_password')
  and p_occurs_since('7 days')
  -- If you wish to investigate an indvidual user , uncomment this line and add their email here  
  -- and actor:alternateId = '<EMAIL_GOES_HERE>'
  ORDER by p_event_time DESC
SnowflakeQuery: >
  SELECT p_event_time,actor:alternateId as actor_user,target[0]:alternateId as target_user, eventType,client:ipAddress as ip_address
  FROM panther_logs.public.okta_systemlog
  WHERE eventType IN ('user.mfa.factor.reset_all', 'user.mfa.factor.deactivate', 'user.mfa.factor.suspend', 'user.account.reset_password', 'user.account.update_password','user.mfa.factor.update')
  and p_occurs_since('7 days')
  -- If you wish to investigate an indvidual user , uncomment this line and add their email here  
  -- and actor:alternateId = '<EMAIL_GOES_HERE>'
  ORDER by p_event_time DESC
Schedule:
  RateMinutes: 43200
  TimeoutMinutes: 1