Standardizing on 90 Day Baselines

[zaynahsmith-dasilva]

Background

THREAT-730

Changes

• Only keeping 90 day baseline lookup tables for ease of use and maintenance. All affiliated detections and queries only utilize the 90 day baselines so the additional okta look up tables (30 day, 180 day) were removed.

Testing

[cursor]

PR Summary

Medium Risk
Touches behavioral detection baselines for Okta; risk is moderate if any tenant still relied on the removed 30/180-day tables, though in-repo references point only at 90-day lookups.

Overview
Standardizes Okta behavioral baselines on 90-day lookup tables only by deleting the 30- and 180-day Panther lookup definitions and trimming the Okta pack to ship just okta_ad_pantherflow_baseline_90d and okta_baseline_90d.

The removed YAML files covered AD-agent Pantherflow baselines and the shared multi-section baselines (general user features plus policy/MFA/SWA/credential-extraction stats for Skeleton Key and SWA behavioral queries). deprecated.txt now lists the retired lookup names (okta_ad_pantherflow_baseline_30d/180d, okta_baseline_30d/180d) so deployments can phase them out cleanly; affiliated scheduled queries are already documented against the 90-day tables.

^{Reviewed by Cursor Bugbot for commit c435af0. Bugbot is set up for automated code reviews on this repo. Configure here.}