# Blog: Using Falco to Create Custom Identity Detections

DevFeed: [Blog: Using Falco to Create Custom Identity Detections](<https://devfeed.tech/articles/blog-using-falco-to-create-custom-identity-detections-32500.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-okta-identity/>)

Published: 2023-11-28T00:00:00Z

Content type: article

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [okta](<https://devfeed.tech/topics/okta.md>), [Security](<https://devfeed.tech/topics/security.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [audit](<https://devfeed.tech/topics/audit.md>), [password reset](<https://devfeed.tech/topics/password-reset.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>)

Tags: [architecture](<https://devfeed.tech/tags/architecture.md>), [audit](<https://devfeed.tech/tags/audit.md>), [blog](<https://devfeed.tech/tags/blog.md>), [event-source](<https://devfeed.tech/tags/event-source.md>), [falco](<https://devfeed.tech/tags/falco.md>), [identity](<https://devfeed.tech/tags/identity.md>), [okta](<https://devfeed.tech/tags/okta.md>), [password-reset](<https://devfeed.tech/tags/password-reset.md>), [security](<https://devfeed.tech/tags/security.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>)

## AI overview

This blog post explains how the open-source Falco Okta plugin can support Identity Threat Detection and Response by analyzing Okta audit logs. It describes default rules, adaptable rule logic, and a custom rule example focused on password-reset activity and potential account takeover.

## Source excerpt

Identity Threat Detection & Response (ITDR) in the cloud is of paramount importance to limit access to sensitive data and maintain the integrity of cloud infrastructure. Leading cloud providers like AWS, Microsoft Azure, and Google Cloud have implemented robust Identity and Access Management (IAM) controls, as well as Multi-Factor Authentication (MFA) options, to ensure that users have the standardized access control limitations. However, as the saying goes, "Trust, but verify." Even with these layers of security, there's a growing concern about what happens when a rogue employee or an external adversary manages to compromise an identity provider. Recent months have witnessed a surge in attacks targeting popular identity providers like Okta, underscoring the critical need for timely and effective detection capabilities. In fact, (Crowdstrike's 2023 Threat Hunting) report had classified 62% of all interactive cyber intrusions as having involved some form of compromised identities. Without proper detection, incidents such as the attacks on organizations like Caesars and MGM might go unnoticed until it's too late. Fortunately, open source Falco offers a Dedicated plugin for the Okta identity platform, empowering security teams to respond swiftly and with the context required to take real action against potential threats. In this blog post, we will delve into how Falco fulfills the requirements for ITDR capabilities. We'll illustrate the significance of Falco's adaptable rule logic and provide readers with a real-world example of crafting custom rules derived directly from Okta audit logs. Understanding the rule logic The Falco Okta plugin comes with a set of valuable default rules for Okta logs, which are designed to assist you in enhancing the security of your Okta platform. A typical illustration of the importance of these rules lies in the process of initiating a password reset within the Okta platform. In practice, an insider threat might reset a password, opt not