MFA Failures

Displays the count of MFA authentication failures caused by service errors or user not being enrolled. A sudden spike in these errors may indicate a service incident requiring immediate investigation and response.

Identitymonitoring

FDR intermediatepor CrowdStrike (cql-hub.com) 1 min read

Query

#repo=base_sensor #event_simpleName=IdpPolicy*RuleMatch
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| case {
  IdpPolicyMfaStatus=128 | MfaError:="User Not Enrolled";
  IdpPolicyMfaStatus=256 | MfaError:="Service Error";
  *;
}
| timeChart(series=MfaError)

Explicación

Importado desde cql-hub.com. Agrega explicación de pipes aquí.

Variables a ajustar

Revisa y ajusta los valores según tu entorno.