from panther_base_helpers import deep_get
from panther_greynoise_helpers import GetGreyNoiseObject
noise = GetGreyNoiseObject(event)
if (event.get("eventType") == "user.session.start" and deep_get(event, "outcome", "result") == "FAILURE"):
return f"A Possible Brute Force Attack on Okta Detected from IP {deep_get(event, 'client', 'ipAddress')}"
if noise.classification("client.ipAddress") == "malicious":
if noise.classification("client.ipAddress") == "benign":
def alert_context(event):
context ={"message": "No GreyNoise Data Available"}
"actor": noise.actor("client.ipAddress"),
"classification": noise.classification("client.ipAddress"),
"ip": noise.ip_address("client.ipAddress"),