Dorothy
Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.
Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.
Checked November 2026.
Created by David French (@threatpunter) at Elastic Security, Dorothy is a tool designed to help security teams test their monitoring and detection capabilities for their Okta environment. It offers modules to simulate attacker actions and security audit actions in an Okta environment, mapped to relevant MITRE ATT&CK® tactics like persistence, defense evasion, and discovery.
Elastic Security's free detection rules for Okta can be found in their detection-rules repository. It is recommended to use Dorothy in a test environment to avoid any impact on the production environment.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Dorothy: features, pricing and alternatives.
Dorothy is a product in the Detection Engineering category. It covers MITRE ATT&CK and Detection Rules.
Dorothy is free. Download and setup instructions are at https://github.com/elastic/dorothy/.
Alternatives to Dorothy listed on CybersecTools:
Compare all Dorothy alternatives at https://cybersectools.com/alternatives/dorothy
Dorothy is available as a cloud service. It is listed for small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Home for rules used by Elastic Security with code for unit testing, Kibana integration, and Red Team Automation.
Community platform for sharing and creating detection rules with AI
A .Net wrapper library for the native Yara library with interoperability and portability features.
Signature-based YARA rules for detecting and preventing threats within Linux, Windows, and macOS systems.
A library of event-based analytics written in EQL to detect adversary behaviors identified in MITRE ATT&CK, providing detection rules for the Elastic Stack.
A testing tool that generates suspect actions to validate and test Falco runtime security monitoring rulesets.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,032 products.
Connect your AI
