Okta: Access to /reports/password-health endpoint outside expected Admin Console use
Flags requests to Okta Password Health report endpoints (/reports/password-health/*) for threat hunting.
FreeReviewedSigma · Low · v5
- Product
- okta
- Service
- okta
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
What it detects
This rule flags any request targeting Okta’s /reports/password-health/ paths, which are intended to be accessed through the Okta Admin Console UI. Attackers may query password health data to profile accounts or support credential-focused attacks, so unexpected access is worth hunting. It relies on Okta service telemetry that includes the requested URI (via debugContext.debugData.requestUri) to match requests containing /reports/password-health/.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-password-health-report-endpoint-accessed-via-reports-password-health-0d58814b
title: "Okta: Access to /reports/password-health endpoint outside expected Admin Console use"
id: fb4d67d6-b495-4977-9764-1f99bc6aae46
status: test
description: This rule flags any request targeting Okta’s /reports/password-health/ paths, which are intended to be accessed through the Okta Admin Console UI. Attackers may query password health data to profile accounts or support credential-focused attacks, so unexpected access is worth hunting. It relies on Okta service telemetry that includes the requested URI (via debugContext.debugData.requestUri) to match requests containing /reports/password-health/.
references:
- https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/okta/okta_password_health_report_query.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-10-25
tags:
- attack.credential-access
- detection.threat-hunting
logsource:
service: okta
product: okta
detection:
selection:
debugContext.debugData.requestUri|contains: /reports/password-health/
condition: selection
falsepositives:
- OKTA Admin Activites via Web Console UI.
- This rule is recommended to be used for threat hunting, especially in the context of OKTA support incident in OCT-2023.
- This rule can be used to hunt the activity against endpoints like /reports/password-health/async_csv_download_schedule?, which are typically used from Okta Admin Console UI only, without any corresponding admin console login. See reference
level: low
license: DRL-1.1
related:
- id: 0d58814b-1660-4d31-8c93-d1086ed24cba
type: derived