Quality updates for Okta SSO Content

[rahul0216]

Required items, please complete

Change(s):

• Refine multiple Okta SSO analytic rules and hunting queries: improve KQL parsing and filtering, introduce configurable variables (thresholds, allowed IPs/users/admins, lookback), add isnotempty guards, better JSON parsing, and explicit projections. Standardize entity mappings by splitting actor_alternateId into AccountName and UPNSuffix across rules, add customDetails and alertDetailsOverride where appropriate, update MITRE sub-technique IDs, adjust tactics/techniques, sort/order results, and bump rule versions. These changes reduce false positives, provide richer alert context, and improve hunt/query accuracy and usability.

Reason for Change(s):

• Quality update

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[contentautomationbot]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.