detect-okta-mfa-fatigue

Attack pattern

Okta push bombing / MFA fatigue is the pattern where an attacker repeatedly triggers Okta Verify push challenges until a user eventually approves one or becomes conditioned to repeated prompts. In Okta System Log terms, that pattern shows up as a burst of:

• system.push.send_factor_verify_push
• user.mfa.okta_verify.deny_push
• user.mfa.okta_verify.deny_push_upgrade_needed
• or the OIE generic failure path user.authentication.auth_via_mfa with INVALID_CREDENTIALS while the authenticator is Okta Verify

This skill keeps the logic narrow to those verified event families. It does not guess at every MFA-related event type in the catalog.

Detection logic