Home

Created by David French (@threatpunter) at Elastic Security

Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and actions that security teams should be able to audit. The modules are mapped to the relevant MITRE ATT&CK® tactics, such as Persistence, Defense Evasion, Discovery, and Impact.

Elastic Security's free detection rules for Okta can be found in our detection-rules repo. You can read this blog post to learn more about how Elastic Security helps with cloud monitoring and detection.

Dorothy can change the configuration of your Okta environment. Consider using Dorothy in a test environment to avoid any risk of impacting your production environment.