Intense SSO failures

DragomirGaliaIT — Mon, 20 Mar 2023 12:45:57 GMT

Hello everyone,

Recently after the update we started getting errors for SSO that say Intense SSO failures.
While investigating execution chain, I only ran into outcome reason as "Strong authentication is required or device authentication failed".
Is there anything else we can investigate here, is this something we need to worry about or?

Best regards.

Re: Intense SSO failures

mavraham — Mon, 20 Mar 2023 13:32:55 GMT

Hi @DragomirGaliaIT, thank you for writing to Live Community.

The Intense SSO Failure alert is an analytics alert from AzureAD or OKTA resulting from an abnormally high amount of SSO authentication attempts being made within a short period of time, which could suggest a potential brute-force attack.

You can read more about the alert logic, as well as some suggestive investigative actions in our documentation page.

Hope this helps!

topic Intense SSO failures in Cortex XDR Discussions

Intense SSO failures

Re: Intense SSO failures