# Source: https://docs.datadoghq.com/security/default_rules/def-002-801.md

---
title: Okta application enumeration by user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Okta application enumeration by user
---

# Okta application enumeration by user
Classification:attackTactic:[TA0007-discovery](https://attack.mitre.org/tactics/TA0007)Technique:[T1526-cloud-service-discovery](https://attack.mitre.org/techniques/T1526) 
## Goal{% #goal %}

Detect and investigate attempts to enumerate applications using Okta, which may indicate an attacker is probing for accessible resources to facilitate lateral movement.

## Strategy{% #strategy %}

This rule monitors enumeration activities via Okta where repeated queries are made to list available applications. Such behavior may suggest an attempt to identify accessible resources and potentially map out targets for lateral movement.

## Triage and Response{% #triage-and-response %}

1. Validate the user activity:

   - Check if the user account (`{{@usr.name}}`) or associated IP address has a legitimate reason for listing applications.
   - Review recent authentication attempts and associated IP addresses to determine if there are additional signs of compromise or unauthorized access.

1. Investigate suspicious enumeration activity:

   - Review Okta logs for additional enumeration patterns, such as repeated application listing requests from the same IP or user within a short time frame.
   - Examine logs for any unusual or infrequent applications being accessed or targeted in enumeration requests.

1. Containment and remediation:

   - If the enumeration activity is deemed unauthorized, consider restricting the user's access temporarily and resetting credentials to prevent further probing.
   - Conduct a broader investigation into recent activity from the flagged user and IP to check for other signs of lateral movement, such as privilege escalation or additional resource access attempts.