core.user_auth.mfa_bypass_attempted - OKTA event

[shahravi88]

Has anyone dealt with this event? I'm reviewing different panels in OKTA app and I found one which looks for MFA bypass attempt. I'm trying to find more information such as why this event is triggered and what to do about it.

[shahravi88]

Thank you for the link Mumble! I came across that resource when I was looking into this issue but I didn't find it much useful. OKTA doesn't have any details as to what that message means and why it is being triggered. I will try your suggestion to see if that leads anywhere.

Thanks for the help.

[muebel]

I haven't dealt with the error itself, but this app might help you with this sourcetype : http://docs.splunk.com/Documentation/AddOns/released/OKTA/Lookups

I'd search for more context to the event, like which user triggered it, and how often it happens.

Let me know if this helps!