Okta User

eventType	Description	Sample	Rule
user.account.expire_password	Fired when the user's Okta password is expired.	Y	N
user.account.lock	Auto-lock user account for Okta.	Y	Y
user.account.lock.limit	User account reached lockout limit and will not be automatically unlocked.	N	Y
user.account.preference_update	User preferences updated.	N	N
user.account.privilege.grant	A User's admin privileges changed.	Y	Y
user.account.privilege.revoke	All of user's admin privilege revoked.	Y	N
user.account.report_suspicious_activity_by_enduser	User reported suspicious activity.	Y	Y
user.account.reset_password	User's Okta password has been reset.	Y	Y
user.account.subscriptions.update	Admin subscriptions update.	Y	N
user.account.unlock	Auto-unlock user account for Okta.	N	N
user.account.unlock_by_admin	User account unlock by admin.	Y	N
user.account.unlock_failure	Failed to schedule unlock job for user.	N	N
user.account.unlock_token	Issued recovery token for self-service account unlock.	N	Y
user.account.update_password	User update password for Okta.	Y	Y
user.account.update_primary_email	User primary email updated.	N	N
user.account.update_profile	Update user profile for Okta.	Y	N
user.account.update_secondary_email	User secondary email updated.	N	N
user.account.update_user_type	Fires when a user changes from one type to another.	N	N
user.account.use_token	Invalid self service recovery token used by user.	N	N
user.authentication.auth	Authenticate user.	N	Y
user.authentication.auth_identifier_not_in_policy	Authenticate a user with an identifier that's not in the User Profile Policy.	N	Y
user.authentication.auth_unconfigured_identifier	Fired after a user authenticates via a directory instance that is not the highest priority profile source for the user.	N	Y
user.authentication.auth_via_AD_agent	Authenticate user with AD agent.	Y	Y
user.authentication.auth_via_IDP	Authenticate user via IDP.	N	Y
user.authentication.auth_via_LDAP_agent	Authenticate user via LDAP agent.	N	Y
user.authentication.auth_via_inbound_SAML	Authenticate user via inbound SAML.	N	Y
user.authentication.auth_via_inbound_delauth	Authenticate user via inbound delauth.	N	Y
user.authentication.auth_via_iwa	Authenticate user via IWA.	N	Y
user.authentication.auth_via_mfa	Authentication of user via MFA.	Y	Y
user.authentication.auth_via_radius	Authentication of user via Radius.	N	Y
user.authentication.auth_via_richclient	Authentication of a user via Rich Client.	N	Y
user.authentication.auth_via_social	Authenticate user with social login.	N	Y
user.authentication.authenticate	Authentication via device trust certificate.	N	Y
user.authentication.dsso_via_non_priority_source	Desktop Single Sign On (DSSO) authentication has been attempted using a profile source that is not the highest priority profile source for the given Okta user.	N	Y
user.authentication.slo	User single logout out (SLO) from app.	N	Y
user.authentication.sso	Fired when a user performs a single sign-on (SSO) to an app instance and contains the client details of the user.	Y	Y
user.authentication.universal_logout	This event is fired when an admin or system account triggers Universal Logout against an app instance.	Y	Y
user.authentication.universal_logout.scheduled	This event is fired when an admin manually triggers Universal Logout for a user.	Y	Y
user.authentication.verify	Verify user identity.	Y	Y
user.behavior.profile.reset	User behavior profile reset.	N	N
user.credential.enroll	Device Trust certificate enrollment.	N	N
user.device_session.end	User ended a device session.	N	N
user.device_session.start	User established a device session.	N	N
user.identity_snapshot.attestation.create	Create identity snapshot attestation for a user.	N	N
user.identity_verification	This event is fired when a user is directed to complete an Identity Verification as a result of an Okta Account Management (OAMP) Policy evaluation.	N	N
user.identity_verification.start	An Okta account management policy (OAMP) prompted the user to verify their identity with an identity verification service.	N	N
user.import.password	Imported user password from external system during login.	N	N
user.lifecycle.activate	Activate Okta user.	Y	Y
user.lifecycle.create	Create Okta user.	Y	Y
user.lifecycle.deactivate	Deactivate Okta user.	Y	N
user.lifecycle.delete.completed	Delete Okta user completed.	Y	N
user.lifecycle.delete.initiated	Delete Okta user initiated.	Y	N
user.lifecycle.jit.error.read_only	Failed to JIT create user.	N	N
user.lifecycle.password_mass_expiry	Mass expire all users' passwords initiated.	N	N
user.lifecycle.reactivate	Reactivate Okta user.	N	N
user.lifecycle.suspend	Suspend Okta user.	Y	N
user.lifecycle.unsuspend	Unsuspend Okta user.	Y	N
user.mfa.attempt_bypass	Attempt bypass of factor.	N	Y
user.mfa.factor.activate	Activate factor or authenticator enrollment method for user.	Y	Y
user.mfa.factor.deactivate	Reset factor or authenticator enrollment method for user.	Y	Y
user.mfa.factor.reset_all	Reset all factors or authenticator enrollments for user.	Y	Y
user.mfa.factor.suspend	Suspend factor or authenticator enrollment method for user.	Y	Y
user.mfa.factor.unsuspend	Unsuspend factor or authenticator enrollment method for user.	Y	N
user.mfa.factor.update	Update factor for user.	Y	Y
user.mfa.okta_verify	Verify user with Okta verify.	N	N
user.mfa.okta_verify.deny_push	User rejected Okta push verify.	N	Y
user.mfa.okta_verify.deny_push_upgrade_needed	Rejected Okta push verify as Upgrade Needed.	N	N
user.risk.change	Indicates a user's risk level has changed.	N	N
user.risk.detect	Indicates a user risk was detected.	Y	N
user.session.access_admin_app	User accessing Okta admin app.	Y	Y
user.session.clear	Clear user session.	Y	N
user.session.context.change	User session context changed.	Y	N
user.session.end	User logout from Okta.	Y	N
user.session.expire	Expire user session.	N	N
user.session.impersonation.end	End impersonation session.	N	N
user.session.impersonation.extend	Extend impersonation session.	N	N
user.session.impersonation.grant	Enable impersonation grant.	N	Y
user.session.impersonation.initiate	Initiate impersonation session.	N	Y
user.session.impersonation.revoke	Revoke impersonation grant.	N	N
user.session.start	User login to Okta.	Y	Y
user.mfa.promote_enrollment	Promote authenticator enrollment during login to Okta.	N	N
user.realm.update	User realm updated.	Y	N

user.account.expire_password

Description

Fired when the user's Okta password is expired. This can be used to audit cases where a user's password is expired by an administrator. When fired, this event contains information about the user whose password was expired, whether a temporary password was created for the user, or if the user's sessions were revoked.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000100",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Fired when the user's Okta password is expired",
  "eventType": "user.account.expire_password",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T19:04:45.545Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000021/lifecycle/expire_password",
      "url": "/api/v1/users/00u00000000000000021/lifecycle/expire_password?"
    }
  },
  "legacyEventType": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.account.expire_password

user.account.lock

Description

Auto-lock user account for Okta.

Example System Log Event #

{
  "actor": {
    "alternateId": "user16@dw-harness.example",
    "detailEntry": null,
    "displayName": "DW Harness 25",
    "id": "00u00000000000000022",
    "type": "User"
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "authenticationStep": 0,
    "credentialProvider": null,
    "credentialType": null,
    "externalSessionId": "0000000000000000000000101",
    "interface": null,
    "issuer": null
  },
  "client": {
    "device": "Computer",
    "geographicalContext": {
      "city": "Anytown",
      "country": "Placeholderland",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      },
      "postalCode": "00000",
      "state": "Anystate"
    },
    "id": null,
    "ipAddress": "198.51.100.10",
    "userAgent": {
      "browser": "CHROME",
      "os": "Mac OS 14.3.1 (Sonoma)",
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
    },
    "zone": "null"
  },
  "debugContext": {
    "debugData": {
      "authnRequestId": "00000000000000000000000000000006",
      "deviceFingerprint": "00000000000000000000000000000102",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000103",
      "oktaUserAgentExtended": "okta-auth-js/7.0.1 okta-signin-widget-7.15.1",
      "requestId": "00000000000000000000000000000104",
      "requestUri": "/idp/idx/identify",
      "threatSuspected": "false",
      "url": "/idp/idx/identify?"
    }
  },
  "device": null,
  "displayMessage": "Max sign in attempts exceeded",
  "eventType": "user.account.lock",
  "legacyEventType": "core.user_auth.account_locked",
  "outcome": {
    "reason": "LOCKED_OUT",
    "result": "FAILURE"
  },
  "published": "2024-03-01T20:49:05.312Z",
  "request": {
    "ipChain": [
      {
        "geographicalContext": {
          "city": "Anytown",
          "country": "Placeholderland",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          },
          "postalCode": "00000",
          "state": "Anystate"
        },
        "ip": "198.51.100.10",
        "source": null,
        "version": "V4"
      }
    ]
  },
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "domain": "example.com",
    "isProxy": false,
    "isp": "example-isp"
  },
  "severity": "DEBUG",
  "target": null,
  "transaction": {
    "detail": {},
    "id": "00000000000000000000000000000104",
    "type": "WEB"
  },
  "uuid": "00000000-0000-0000-0000-000000000016",
  "version": "0"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`All_Changes.object_category` (splunk rule field)	eq	`user`	1 rule	splunk
`count` (splunk rule field)	gt	`5`	1 rule	splunk
`security_result.action (Chronicle)`	eq	`BLOCK`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta User Account Locked Out source medium: Detects when an user account is locked out.T1531

Elastic #

Attempts to Brute Force an Okta User Account source medium: Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts.T1110, T1110.001, T1110.003

Splunk #

Okta Multiple Accounts Locked Out source: The following analytic detects multiple Okta accounts being locked out within a short period. It uses the user.account.lock event from Okta logs, aggregated over a 5-minute window, to identify this behavior. This activity is significant as…T1110

YARA-L #

Okta User Account Lockout source medium: Detects when a user's account is locked out or a user account has reached the lockout limit.T1078↳ also matches user.account.lock.limit

Panther #

Okta User Account Locked source low: An Okta user has locked their account.↳ also matches user.account.lock.limit

References #

user.account.lock.limit

Description

User account reached lockout limit and will not be automatically unlocked. This event indicates an account that will not be able to log in until remedial action is taken by the account admin. This event can be used to understand the specifics of an account lockout. Often this indicates a client application that is repeatedly attempting to authenticate with invalid credentials such as an old password.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`security_result.action (Chronicle)`	eq	`BLOCK`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Okta User Account Lockout source medium: Detects when a user's account is locked out or a user account has reached the lockout limit.T1078↳ also matches user.account.lock

Panther #

Okta User Account Locked source low: An Okta user has locked their account.↳ also matches user.account.lock

References #

Okta Event Types Catalog: user.account.lock.limit

user.account.preference_update

Description

User preferences updated. This can be used for debugging and auditing purposes. These preferences live outside the user profile.

References #

Okta Event Types Catalog: user.account.preference_update

user.account.privilege.grant

Description

A User's admin privileges changed. This can be used to audit the provisioning of admin privileges for users. When fired, this event contains information about the type of admin privileges the user currently has. The list of current privileges contain both individually assigned roles as well as the ones granted to the user through their group membership. Related events include: USER_ACCOUNT_PRIVILEGE_REVOKE.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000105",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Grant user privilege",
  "eventType": "user.account.privilege.grant",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:55:09.050Z",
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "privilegeGranted": "Read only admin"
    }
  },
  "legacyEventType": "core.user.admin_privilege.granted",
  "transaction": {
    "type": null,
    "id": "00000000000000000000",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": []
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    },
    {
      "id": "00000000000000000000",
      "type": "ROLE_ASSIGNED",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    },
    {
      "id": "00000000000000000000",
      "type": "ROLE",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType`	eq	`user.account.privilege.grant`	3 rules	panther, sigma
`eventType`	eq	`group.privilege.grant`	2 rules	panther, sigma
`okta::eventType` (kusto rule field)	in	`policy.evaluate_sign_on`	1 rule	kusto
`okta::eventType` (kusto rule field)	in	`system.api_token.create`	1 rule	kusto
`outcome.result` (panther rule field)	eq	`SUCCESS`	1 rule	panther
`p_occurs_between` (panther rule field)	macro	`'2022-01-14' , '2022-03-22'`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta Admin Role Assigned to an User or Group source medium: Detects when an the Administrator role is assigned to an user or group.T1098, T1098.003

Elastic #

Okta User Assigned Administrator Role source medium: Identifies when an administrator role is assigned to an Okta user or group. Adversaries may assign administrator privileges to compromised accounts to establish persistence, escalate privileges, and maintain long-term access to the environment. This detection monitors for both user-level and group-level administrator privilege grants, which can be used to bypass security controls and perform unauthorized administrative actions.T1098, T1098.003

Kusto #

High-Risk Admin Activity source medium: The Okta risk engine auto-assigns risk levels to each login attempt. This rule identifies successful admin operations that correlate with successful high-risk Okta authentication or session start events.T1078, T1078.004, T1098↳ also matches user.mfa.factor.suspend, user.session.access_admin_app, user.session.impersonation.grant, user.session.start

Panther #

Okta Admin Role Assigned source informational: A user has been granted administrative privileges in OktaT1078
Okta Admin Access Granted source: Audit instances of admin access granted in your okta tenant

References #

Okta Event Types Catalog: user.account.privilege.grant

user.account.privilege.revoke

Description

All of user's admin privilege revoked. This can be used to audit the deprovisioning of admin privileges from users. When fired, this event indicates the user has no more admin privileges. All of user's privileges were revoked including individually assigned roles as well as the ones granted to the user through their group membership. Related events include: USER_ACCOUNT_PRIVILEGE_GRANT.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000106",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Revoke user privilege",
  "eventType": "user.account.privilege.revoke",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:55:09.304Z",
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "privilegeRevoked": "Super administrator, Organization administrator, Application administrator (all), Application administrator, Read only admin, User administrator (all), User administrator, Help Desk administrator (all), Help Desk administrator, Mobile administrator, API Access Management administrator, Report administrator, Group Membership administrator"
    }
  },
  "legacyEventType": "core.user.admin_privilege.revoked",
  "transaction": {
    "type": null,
    "id": "00000000000000000000",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": []
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    },
    {
      "id": "00000000000000000000",
      "type": "ROLE_UNASSIGNED_ALL_PRIVILEGES_REVOKED",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    },
    {
      "id": "00000000000000000000",
      "type": "ROLE",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.account.privilege.revoke

user.account.report_suspicious_activity_by_enduser

Description

User reported suspicious activity. This event is used to identify user account suspicious activity.

Example System Log Event #

{
  "actor": {
    "alternateId": "user11@dw-harness.example",
    "detailEntry": null,
    "displayName": "DW Harness 25",
    "id": "00u00000000000000022",
    "type": "User"
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "authenticationStep": 0,
    "credentialProvider": null,
    "credentialType": null,
    "externalSessionId": "0000000000000000000000107",
    "interface": null,
    "issuer": null
  },
  "client": {
    "device": "Computer",
    "geographicalContext": {
      "city": "Anytown",
      "country": "Placeholderland",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      },
      "postalCode": "00000",
      "state": "Anystate"
    },
    "id": null,
    "ipAddress": "198.51.100.10",
    "userAgent": {
      "browser": "CHROME",
      "os": "Mac OS 11.3.1 (Sonoma)",
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
    },
    "zone": "null"
  },
  "debugContext": {
    "debugData": {
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000103",
      "requestId": "00000000000000000000000000000108",
      "requestUri": "/api/internal/users/me/report-suspicious-activity",
      "suspiciousActivityBrowser": "CHROME",
      "suspiciousActivityEventCity": "Ohio",
      "suspiciousActivityEventCountry": "United States",
      "suspiciousActivityEventId": "00000000-0000-0000-0000-000000000017",
      "suspiciousActivityEventIp": "198.51.100.10",
      "suspiciousActivityEventLatitude": "20.7652",
      "suspiciousActivityEventLongitude": "-20.9588",
      "suspiciousActivityEventState": "Ohio",
      "suspiciousActivityEventTransactionId": "00000000000000000000000000000007",
      "suspiciousActivityEventType": "system.email.mfa_reset_notification.sent_message",
      "suspiciousActivityOs": "Mac OS 14.3.1 (Sonoma)",
      "suspiciousActivityTimestamp": "2024-03-11T16:28:18.184Z",
      "url": "/api/internal/users/me/report-suspicious-activity?i=0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"
    }
  },
  "device": null,
  "displayMessage": "User report suspicious activity",
  "eventType": "user.account.report_suspicious_activity_by_enduser",
  "legacyEventType": "core.user.account.report_suspicious_activity_by_enduser",
  "outcome": {
    "reason": null,
    "result": "SUCCESS"
  },
  "published": "2024-03-11T16:28:40.048Z",
  "request": {
    "ipChain": [
      {
        "geographicalContext": {
          "city": "Anytown",
          "country": "Placeholderland",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          },
          "postalCode": "00000",
          "state": "Anystate"
        },
        "ip": "198.51.100.10",
        "source": null,
        "version": "V4"
      }
    ]
  },
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "domain": "example.com",
    "isProxy": false,
    "isp": "example-isp"
  },
  "severity": "WARN",
  "target": [
    {
      "alternateId": "user11@dw-harness.example",
      "detailEntry": null,
      "displayName": "DW Harness 26",
      "id": "00u00000000000000022",
      "type": "User"
    }
  ],
  "transaction": {
    "detail": {},
    "id": "00000000000000000000000000000108",
    "type": "WEB"
  },
  "uuid": "00000000-0000-0000-0000-000000000018",
  "version": "0"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType`	eq	`user.account.report_suspicious_activity_by_enduser`	2 rules	sigma, splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta Suspicious Activity Reported by End-user source high: Detects when an Okta end-user reports activity by their account as being potentially suspicious.T1586, T1586.003

Elastic #

Suspicious Activity Reported by Okta User source medium: Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network.T1078

Splunk #

Okta Suspicious Activity Reported source: The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the user.account.report_suspicious_activity_by_enduser event type.…T1078, T1078.001

YARA-L #

Okta User Suspicious Activity Reported source medium: An Okta user reports suspicious activity in response to an end user security notification.T1078

Panther #

Okta User Reported Suspicious Activity source high: Suspicious Activity Reporting provides an end user with the option to report unrecognized activity from an account activity email notification. This detection alerts when a user marks the raised activity as suspicious.

References #

user.account.reset_password

Description

User's Okta password has been reset.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000109",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Fired when the user's Okta password is reset",
  "eventType": "user.account.reset_password",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:57.536Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000000",
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000023/lifecycle/reset_password",
      "url": "/api/v1/users/00u00000000000000023/lifecycle/reset_password?sendEmail=false"
    }
  },
  "legacyEventType": "core.user.config.user_status.password_reset",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (panther rule field)	in	`user.account.reset_password`	2 rules	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Okta User Password and MFA Factor Reset or Deactivated source medium: Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.T1556↳ also matches user.mfa.factor.deactivate, user.mfa.factor.reset_all

Panther #

Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.update_password, user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.mfa.factor.suspend, user.mfa.factor.update
Okta Support Reset Credential source high: A Password or MFA factor was reset by Okta SupportT1199↳ also matches user.mfa.attempt_bypass, user.mfa.factor.update

References #

Okta Event Types Catalog: user.account.reset_password

user.account.subscriptions.update

Description

Admin subscriptions update. Use this event to track and audit updated email subscriptions for an admin. This event contains information about email subscription updates for an admin user. Email subscriptions determine the email notification type that Okta sends to an admin user.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000071",
    "externalSessionId": "trs00000000000000072"
  },
  "displayMessage": "Admin subscriptions updated",
  "eventType": "user.account.subscriptions.update",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-25T23:24:07.373Z",
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "severity": "DEBUG",
  "debugContext": {
    "debugData": {}
  },
  "gatewayContext": null,
  "legacyEventType": null,
  "transaction": {
    "type": null,
    "id": "0000002",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000101",
  "version": "0",
  "request": {
    "ipChain": []
  },
  "target": [
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "OKTA_ISSUE"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "USER_LOCKED_OUT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "AD_AGENT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "OKTA_ANNOUNCEMENT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "DISASTER_RECOVERY_NOTIFICATION"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "REPORT_SUSPICIOUS_ACTIVITY"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "RATELIMIT_NOTIFICATION"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "USER_DEPROVISION"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "IWA_AGENT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "LDAP_AGENT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "CONNECTOR_AGENT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "APP_IMPORT"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "PROTECTED_ACTIONS_NOTIFICATION"
      }
    },
    {
      "id": "00u00000000000000073",
      "type": "User",
      "alternateId": null,
      "displayName": "DW Harness 03",
      "detailEntry": {
        "notificationStatus": "unsubscribed",
        "notificationChannels": "[email]",
        "notificationType": "OKTA_UPDATE"
      }
    }
  ]
}

References #

Okta Event Types Catalog: user.account.subscriptions.update

user.account.unlock

Description

Auto-unlock user account for Okta.

References #

Okta Event Types Catalog: user.account.unlock

user.account.unlock_by_admin

Description

User account unlock by admin.

Example System Log Event #

{
  "published": 1780403843261,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000129",
  "actor": {
    "id": "00u00000000000000164",
    "type": "User",
    "alternateId": "user03@dw-harness.example",
    "displayName": "DW Harness 04",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36",
      "os": "Mac OS X",
      "browser": "CHROME"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.5",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000330",
      "type": "User",
      "alternateId": "user72@dw-harness.example",
      "displayName": "DW Harness 113",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.5",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.account.unlock_by_admin",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000066",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "behaviors": "{New Geo-Location=BAD_REQUEST, New Device=BAD_REQUEST, New ASN=BAD_REQUEST, New IP=NEGATIVE, New State=BAD_REQUEST, New Country=BAD_REQUEST, Velocity=BAD_REQUEST, New City=BAD_REQUEST}",
      "requestId": "00000000000000000000000000000066",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000029",
      "risk": "{reasons=Anomalous Location, level=MEDIUM}",
      "requestUri": "000000000000000000000000000000000000000000000000002",
      "url": "000000000000000000000000000000000000000000000000002?"
    }
  },
  "displayMessage": "User account unlock by admin",
  "gatewayContext": null,
  "legacyEventType": "core.user_auth.account_unlocked_by_admin",
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "MEDIUM",
      "reasons": [
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000052",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New ASN",
        "id": "bhv00000000000000053",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000054",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000055",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000056",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000057",
        "result": "BAD_REQUEST"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000058",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000059",
        "result": "NEGATIVE"
      }
    ]
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000331",
    "externalSessionId": "10200000000000000331"
  }
}

References #

user.account.unlock_failure

Description

Failed to schedule unlock job for user.

References #

Okta Event Types Catalog: user.account.unlock_failure

user.account.unlock_token

Description

Issued recovery token for self-service account unlock.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

High Number of Okta User Password Reset or Unlock Attempts source medium: Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection.T1078, T1078.004

References #

Okta Event Types Catalog: user.account.unlock_token

user.account.update_password

Description

User update password for Okta.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000110",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "User update password for Okta",
  "eventType": "user.account.update_password",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T19:04:45.332Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users",
      "url": "/api/v1/users?activate=true"
    }
  },
  "legacyEventType": "core.user.config.password_update.success",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (panther rule field)	in	`user.account.reset_password`	1 rule	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.reset_password, user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.mfa.factor.suspend, user.mfa.factor.update

References #

Okta Event Types Catalog: user.account.update_password

user.account.update_primary_email

Description

User primary email updated.

References #

Okta Event Types Catalog: user.account.update_primary_email

user.account.update_profile

Description

Update user profile for Okta.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000111",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Update user profile for Okta",
  "eventType": "user.account.update_profile",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:48.087Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000024",
      "changedAttributes": "nickName",
      "url": "/api/v1/users/00u00000000000000024?"
    }
  },
  "legacyEventType": "core.user.config.profile_update.success",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.account.update_profile

user.account.update_secondary_email

Description

User secondary email updated.

References #

Okta Event Types Catalog: user.account.update_secondary_email

user.account.update_user_type

Description

Fires when a user changes from one type to another. Can be used to audit when a user gets converted from a contractor to a full-time employee, for example. Data includes the old and new type ids. There may be an accompanying update_profile event if values were changed.

References #

Okta Event Types Catalog: user.account.update_user_type

user.account.use_token

Description

Invalid self service recovery token used by user.

References #

Okta Event Types Catalog: user.account.use_token

user.authentication.auth

Description

Authenticate user.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth

user.authentication.auth_identifier_not_in_policy

Description

Authenticate a user with an identifier that's not in the User Profile Policy. Identify users who authenticate with an identifier that's not in the User Profile Policy's configured identifier list. Add the identifier to the policy before delegated authentication is disabled (manually or through a Password Migration campaign) to prevent lockout. Distinct from user.authentication.auth_unconfigured_identifier, which concerns directory source priority rather than User Profile Policy identifier rules.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_identifier_not_in_policy

user.authentication.auth_unconfigured_identifier

Description

Fired after a user authenticates via a directory instance that is not the highest priority profile source for the user. This can be used to track users that are using an identifier to login which is different from the admin configured identifier for that user which might result in unexpected login results. When fired, this event will contain useful information about the user, the directory instance that was used to login the user, and the directory instance that should have been used instead.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_unconfigured_identifier

user.authentication.auth_via_AD_agent

Description

Authenticate user with AD agent.

Example System Log Event #

{
  "actor": {
    "alternateId": "user15@dw-harness.example",
    "detailEntry": null,
    "displayName": "DW Harness 24",
    "id": "0000000000000000096",
    "type": "User"
  },
  "authenticationContext": {
    "authenticationProvider": "ACTIVE_DIRECTORY",
    "authenticationStep": 0,
    "credentialProvider": null,
    "credentialType": "PASSWORD",
    "externalSessionId": "0000000000000000000000097",
    "interface": "AD APP Instance",
    "issuer": null,
    "rootSessionId": "0000000000000000000000097"
  },
  "client": {
    "device": "Computer",
    "geographicalContext": {
      "city": "Anytown",
      "country": "Placeholderland",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      },
      "postalCode": "00000",
      "state": "Anystate"
    },
    "id": null,
    "ipAddress": "198.51.100.13",
    "userAgent": {
      "browser": "CHROME",
      "os": "Windows 10",
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
    },
    "zone": "null"
  },
  "debugContext": {
    "debugData": {
      "actionid": "rpc::0000000000000000000000000000000000000000000003//1731969275290//00000000000000000000000000000008:00000000-0000-0000-0000-000000000019:",
      "agentid": "a5300000000000000013",
      "authnRequestId": "00000000000000000000000000000005",
      "behaviors": "{New Geo-Location=POSITIVE, New Device=POSITIVE, New IP=POSITIVE, New State=POSITIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}",
      "delauthtimeout": "4000",
      "delauthtimespentatagent": "16",
      "delauthtimespentatdomaincontroller": "16",
      "delauthtimetotal": "184",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000112",
      "errorCode": "1326",
      "requestId": "00000000000000000000000000000113",
      "requestUri": "/idp/idx/challenge/answer",
      "risk": "{reasons=Anomalous Device, level=MEDIUM}",
      "threatSuspected": "false",
      "url": "/idp/idx/challenge/answer?"
    }
  },
  "device": null,
  "displayMessage": "Authenticate user with AD agent",
  "eventType": "user.authentication.auth_via_AD_agent",
  "legacyEventType": "app.ad.login.bad_password",
  "outcome": {
    "reason": "Authentication failed: bad username or password",
    "result": "FAILURE"
  },
  "published": "2024-11-18T22:34:31.474Z",
  "request": {
    "ipChain": [
      {
        "geographicalContext": {
          "city": "Anytown",
          "country": "Placeholderland",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          },
          "postalCode": "00000",
          "state": "Anystate"
        },
        "ip": "198.51.100.13",
        "source": null,
        "version": "V4"
      }
    ]
  },
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "domain": "example.com",
    "isProxy": false,
    "isp": "example-isp"
  },
  "severity": "ERROR",
  "target": [
    {
      "alternateId": "user17@dw-harness.example",
      "detailEntry": null,
      "displayName": "DW Harness 27",
      "id": "00000000000000000114",
      "type": "AppUser"
    },
    {
      "alternateId": "user18@dw-harness.example",
      "detailEntry": null,
      "displayName": "DW Harness 28",
      "id": "0oa00000000000000025",
      "type": "AppInstance"
    }
  ],
  "transaction": {
    "detail": {},
    "id": "00000000000000000000000000000113",
    "type": "WEB"
  },
  "uuid": "00000000-0000-0000-0000-000000000020",
  "version": "0"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`is_anomalous` (panther rule field)	eq	`true`	1 rule	panther
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more

Show 7 more (10 total) on the rules page

Panther #

Okta AD Agent Authentication Anomaly - Z-Score Detection source medium linked query: Query.Okta.ADAgentAuthZScoreAnomaly: Detects potential Okta AD Agent token theft and credential abuse using statistical z-score analysis. This detection uses a lookup table containing 90-day behavioral baselines for each user's AD Agent authentication patterns, then calculates z-scores to identify suspicious activity in the last 7 days. PREREQUISITES: 1. Baseline builder query must run first: Query.Okta.ADAgentBaselineBuilder 2. Lookup table must be configured: okta_ad_pantherflow_baseline_90d 3. Allow 24 hours for initial baseline to populate Detection Logic: - Calculates mean and standard deviation for hourly authentication volume, IP diversity, country diversity, and device diversity - Alerts when recent activity shows BOTH: 1. Volume spike (z-score > 3 standard deviations) 2. Geographic/IP diversity spike (z-score > 2 standard deviations) Why This Matters: Token theft attacks have a distinct signature: stolen credentials are used from multiple locations/IPs simultaneously or in rapid succession. This creates both a volume spike and a diversity spike that this detection identifies. Complementary Detection: This rule complements Okta.ADAgent.TokenAbuse.Behavioral which detects admin actions (token creation, agent configuration) from new sources. This rule detects the actual USE of stolen tokens through authentication patterns.T1078, T1110, T1528
Query.Okta.ADAgentAuthZScoreAnomaly source: Detects anomalous authentication patterns via Okta AD Agent using z-score statistical analysis. Reads behavioral baseline from lookup table and alerts when recent activity shows volume spikes combined with geographic/IP diversity anomalies - indicators of token theft and credential abuse. PREREQUISITE: Requires the baseline builder query to populate the lookup table first.

References #

user.authentication.auth_via_IDP

Description

Authenticate user via IDP.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`failure`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Okta Sign-In Events via Third-Party IdP source medium: Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP) that has not been seen before. Adversaries may add an unauthorized IdP to an Okta tenant to gain persistent access. This rule uses New Terms detection to only alert when a previously unseen IdP is used for authentication, reducing noise from legitimate federated identity providers while highlighting potentially rogue IdP additions.T1078, T1078.004, T1199↳ also matches user.authentication.auth_via_inbound_SAML, user.authentication.auth_via_social
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_LDAP_agent, user.authentication.auth_via_inbound_SAML, and 14 more

Show 8 more (11 total) on the rules page

Panther #

Okta Identity Provider Sign-in source high: A user has signed in using a 3rd party Identity Provider. Attackers have been observed configuring a second Identity Provider to act as an "impersonation app" to access applications within the compromised Org on behalf of other users. This second Identity Provider, also controlled by the attacker, would act as a “source” IdP in an inbound federation relationship (sometimes called “Org2Org”) with the target. From this “source” IdP, the threat actor manipulated the username parameter for targeted users in the second “source” Identity Provider to match a real user in the compromised “target” Identity Provider. This provided the ability to Single sign-on (SSO) into applications in the target IdP as the targeted user. Do not use this rule if your organization uses legitimate 3rd-party Identity Providers.T1098, T1199

References #

Okta Event Types Catalog: user.authentication.auth_via_IDP

user.authentication.auth_via_LDAP_agent

Description

Authenticate user via LDAP agent.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_inbound_SAML, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_inbound_SAML, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_inbound_SAML, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_LDAP_agent

user.authentication.auth_via_inbound_SAML

Description

Authenticate user via inbound SAML.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::actor.alternateId` (elastic rule field)	is_not_null		6 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`failure`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`success`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 8 more (11 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_inbound_SAML

user.authentication.auth_via_inbound_delauth

Description

Authenticate user via inbound delauth.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventType` (elastic rule field)	eq	`user.session.start`	8 rules	elastic
`EventType` (elastic rule field)	starts_with	`user.authentication.`	8 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`invalid_credentials`	5 rules	elastic
`okta::outcome.reason` (elastic rule field)	in	`locked_out`	5 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`10`	2 rules	elastic
`Esql.total_attempts` (elastic rule field)	ge	`25`	2 rules	elastic
`Esql.unique_source_ips` (elastic rule field)	ge	`5`	2 rules	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	is_not_null		1 rule	elastic
`okta::debugContext.debugData.dt_hash` (elastic rule field)	ne	`-`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_inbound_delauth

user.authentication.auth_via_iwa

Description

Authenticate user via IWA.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_iwa

user.authentication.auth_via_mfa

Description

Authentication of user via MFA. For Okta Classic orgs, this event will only fire for second factor verifications, whereas for Identity Engine orgs, this event will fire for both primary and second factor verifications.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000128",
    "type": "User",
    "alternateId": "user33@dw-harness.example",
    "displayName": "DW Harness 60",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0",
      "os": "Windows 11",
      "browser": "CHROMIUM_EDGE"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": {
    "id": null,
    "name": null,
    "os_platform": null,
    "os_version": null,
    "managed": null,
    "registered": null,
    "device_integrator": {
      "DEVICE_IDP": {}
    },
    "disk_encryption_type": null,
    "screen_lock_type": null,
    "jailbreak": null,
    "secure_hardware_present": null
  },
  "authenticationContext": {
    "authenticationProvider": "FACTOR_PROVIDER",
    "credentialProvider": "OKTA_CREDENTIAL_PROVIDER",
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "idx00000000000000131",
    "externalSessionId": "idx00000000000000131"
  },
  "displayMessage": "Authentication of user via MFA",
  "eventType": "user.authentication.auth_via_mfa",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-26T00:27:43.233Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "HIGH",
      "reasons": [
        "Anomalous Location",
        "Anomalous Device"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000132",
        "result": "UNKNOWN"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000133",
        "result": "UNKNOWN"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000134",
        "result": "UNKNOWN"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000135",
        "result": "UNKNOWN"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000136",
        "result": "UNKNOWN"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000137",
        "result": "UNKNOWN"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000138",
        "result": "UNKNOWN"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000139",
        "result": "UNKNOWN"
      }
    ]
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000155",
      "deviceFingerprint": "00000000000000000000000000000122",
      "behaviors": "{New Geo-Location=UNKNOWN, New Device=UNKNOWN, New ASN=UNKNOWN, New IP=UNKNOWN, New State=UNKNOWN, New Country=UNKNOWN, Velocity=UNKNOWN, New City=UNKNOWN}",
      "authenticatorMethodChallengeTime": "2026-07-26T00:27:42.721Z",
      "origin": "https://dev-00000.okta.com",
      "requestUri": "/idp/idx/challenge/answer",
      "url": "/idp/idx/challenge/answer?",
      "authnRequestId": "00000000000000000000000000000121",
      "requestId": "00000000000000000000000000000124",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000005",
      "risk": "{reasons=Anomalous Location, Anomalous Device, level=HIGH}",
      "threatSuspected": "false",
      "factor": "PASSWORD_AS_FACTOR",
      "factorIntent": "AUTHENTICATION"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.user.factor.attempt_success",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000124",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000156",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00u00000000000000128",
      "type": "User",
      "alternateId": "user33@dw-harness.example",
      "displayName": "DW Harness 60",
      "detailEntry": null
    },
    {
      "id": "lae00000000000000144",
      "type": "AuthenticatorEnrollment",
      "alternateId": "user03@dw-harness.example",
      "displayName": "Password",
      "detailEntry": {
        "methodTypeUsed": "Password",
        "methodUsedVerifiedProperties": "[USER_PRESENCE]"
      }
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType`	eq	`user.authentication.auth_via_mfa`	6 rules	panther, sigma, splunk
`okta::eventType`	eq	`user.authentication.auth_via_mfa`	5 rules	elastic, kusto
`okta::eventType`	eq	`user.mfa.okta_verify.deny_push`	3 rules	elastic, kusto
`okta::eventType` (elastic rule field)	in	`user.authentication.auth_via_mfa`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.sso`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.verify`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.session.start`	3 rules	elastic
`security_result.action (Chronicle)`	eq	`BLOCK`	3 rules	chronicle
`okta::debugContext.debugData.factor` (elastic rule field)	eq	`OKTA_VERIFY_PUSH`	2 rules	elastic
`okta::outcome.reason` (elastic rule field)	eq	`INVALID_CREDENTIALS`	2 rules	elastic
`okta::outcome.result` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	2 rules	elastic
`outcome.reason`	eq	`fastpass declined phishing attempt`	2 rules	sigma, splunk
`outcome.result`	eq	`failure`	2 rules	sigma, splunk
`security_result.detection_fields["factor"] (Chronicle)`	eq	`OKTA_VERIFY_PUSH`	2 rules	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta FastPass Phishing Detection source high: Detects when Okta FastPass prevents a known phishing site.T1566

Elastic #

Okta Multiple OS Names Detected for a Single DT Hash source high: Identifies when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device token and is using it to impersonate a legitimate user from a different machine.T1539↳ also matches user.authentication.verify
Potential Okta MFA Bombing via Push Notifications source high: Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.T1078, T1078.004, T1621↳ also matches user.authentication.sso, user.authentication.verify, user.mfa.okta_verify.deny_push, user.session.start
Potentially Successful Okta MFA Bombing via Push Notifications source high: Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.T1078, T1078.004, T1621↳ also matches user.authentication.sso, user.authentication.verify, user.mfa.okta_verify.deny_push, user.session.start

Show 11 more (14 total) on the rules page

Splunk #

Okta Authentication Failed During MFA Challenge source: The following analytic identifies failed authentication attempts during the Multi-Factor Authentication (MFA) challenge in an Okta tenant. It uses the Authentication datamodel to detect specific failed events where the authentication…T1078, T1078.004, T1586, T1586.003, T1621
Okta Multiple Failed MFA Requests For User source: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this…T1621
Okta Phishing Detection with FastPass Origin Check source: The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the…T1078, T1078.001, T1556

Show 2 more (5 total) on the rules page

Kusto #

Okta Fast Pass phishing Detection source medium: This query detects cases in which Okta FastPass effectively prevented access to a known phishing website.T1566, T1566.002
MFA Fatigue (OKTA) source medium: MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into approving multi-factor authentication prompts, potentially compromising their own security. The query identifies MFA fatigue attempts in Okta by correlating repeated Okta Verify push requests, denied pushes, and eventual successful MFA authentication within the same session. Ref: https://www.okta.com/blog/identity-security/mfa-fatigue-growing-security-concern/.T1621↳ also matches user.mfa.okta_verify.deny_push

YARA-L #

Okta Phishing Detection With Fastpass Origin Check source medium: Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy.T1566
Okta User Failed Number Challenge During Push Notification source medium: Detects when an Okta user failed a number challenge during push notification.T1621
Okta User Rejected Multiple Push Notifications source medium: Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.T1110↳ also matches user.mfa.okta_verify.deny_push

Show 2 more (5 total) on the rules page

Panther #

Okta AiTM Phishing Attempt Blocked by FastPass source high: Okta FastPass detected a user targeted by attackers wielding real-time (AiTM) proxies.T1078.004, T1556, T1566

References #

Okta Event Types Catalog: user.authentication.auth_via_mfa

user.authentication.auth_via_radius

Description

Authentication of user via Radius.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_radius

user.authentication.auth_via_richclient

Description

Authentication of a user via Rich Client.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.auth_via_richclient

user.authentication.auth_via_social

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::outcome.result` (elastic rule field)	eq	`failure`	1 rule	elastic

user.authentication.authenticate

Description

Authentication via device trust certificate.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.authenticate

user.authentication.dsso_via_non_priority_source

Description

Desktop Single Sign On (DSSO) authentication has been attempted using a profile source that is not the highest priority profile source for the given Okta user. This event may indicate a potential security risk as the highest priority profile source is often expected to be used in this flow. The presence of this event may be benign, or it may indicate an attempt to authenticate the user from a compromised Active Directory domain. The debugContext object in this event contains useful information regarding the Okta user, the prioritized profile source, and the profile source that was used in the DSSO attempt.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.dsso_via_non_priority_source

user.authentication.slo

Description

User single logout out (SLO) from app.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

Okta Event Types Catalog: user.authentication.slo

user.authentication.sso

Description

Fired when a user performs a single sign-on (SSO) to an app instance and contains the client details of the user. Can be used to identify when a user attempted to sign into an application for audit or debugging purposes. Note that the event is fired even when the sign-on is unsuccessful.

Example System Log Event #

{
  "actor": {
    "alternateId": "user10@dw-harness.example",
    "detailEntry": null,
    "displayName": "DW Harness 13",
    "id": "00u00000000000000012",
    "type": "User"
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "authenticationStep": 0,
    "credentialProvider": null,
    "credentialType": null,
    "externalSessionId": "0000000000000000000000052",
    "interface": null,
    "issuer": null
  },
  "client": {
    "device": "Computer",
    "geographicalContext": {
      "city": "Anytown",
      "country": "Placeholderland",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      },
      "postalCode": "00000",
      "state": "Anystate"
    },
    "id": "00000000000000000000000000000000000000118",
    "ipAddress": "198.51.100.8",
    "userAgent": {
      "browser": "CHROME",
      "os": "Mac OS 13.6.6 (Ventura)",
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
    },
    "zone": "null"
  },
  "debugContext": {
    "debugData": {
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000119",
      "initiationType": "NA",
      "redirectUri": "https://dev-00000.okta.com/enduser/callback",
      "requestId": "00000000000000000000000000000120",
      "requestUri": "/oauth2/v1/token",
      "signOnMode": "OpenID Connect",
      "threatSuspected": "false",
      "url": "/oauth2/v1/token?"
    }
  },
  "device": null,
  "displayMessage": "User single sign on to app",
  "eventType": "user.authentication.sso",
  "legacyEventType": "app.auth.sso",
  "outcome": {
    "reason": null,
    "result": "SUCCESS"
  },
  "published": "2024-04-08T19:08:02.941Z",
  "request": {
    "ipChain": [
      {
        "geographicalContext": {
          "city": "Anytown",
          "country": "Placeholderland",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          },
          "postalCode": "00000",
          "state": "Anystate"
        },
        "ip": "198.51.100.8",
        "source": null,
        "version": "V4"
      }
    ]
  },
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "domain": "example.com",
    "isProxy": false,
    "isp": "example-isp"
  },
  "severity": "INFO",
  "target": [
    {
      "alternateId": "Okta Dashboard",
      "detailEntry": {
        "signOnModeType": "OPENID_CONNECT"
      },
      "displayName": "Okta Dashboard",
      "id": "0oa00000000000000003",
      "type": "AppInstance"
    },
    {
      "alternateId": "user10@dw-harness.example",
      "detailEntry": null,
      "displayName": "DW Harness 13",
      "id": "00000000000000000121",
      "type": "AppUser"
    }
  ],
  "transaction": {
    "detail": {},
    "id": "00000000000000000000000000000120",
    "type": "WEB"
  },
  "uuid": "00000000-0000-0000-0000-000000000022",
  "version": "0"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType` (elastic rule field)	eq	`user.authentication.auth_via_mfa`	2 rules	elastic
`okta::eventType` (elastic rule field)	eq	`user.mfa.okta_verify.deny_push`	2 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.sso`	4 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.session.start`	4 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.auth_via_mfa`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.verify`	3 rules	elastic
`eventType`	eq	`user.authentication.sso`	2 rules	panther, splunk
`eventType` (splunk rule field)	eq	`policy.evaluate_sign_on`	1 rule	splunk
`okta::debugContext.debugData.factor` (elastic rule field)	eq	`OKTA_VERIFY_PUSH`	2 rules	elastic
`okta::outcome.reason` (elastic rule field)	eq	`INVALID_CREDENTIALS`	2 rules	elastic
`okta::outcome.result` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	2 rules	elastic
`admin_email` (panther rule field)	is_not_null		1 rule	panther
`is_anomalous` (panther rule field)	eq	`true`	1 rule	panther
`okta::actor.alternateId` (elastic rule field)	ne	`system@okta.com`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Successful Application SSO from Rare Unknown Client Device source medium: Detects successful single sign-on (SSO) events to Okta applications from an unrecognized or "unknown" client device, as identified by the user-agent string. This activity may be indicative of exploitation of a vulnerability in Okta's Classic Engine, which could allow an attacker to bypass application-specific sign-on policies, such as device or network restrictions. The vulnerability potentially enables unauthorized access to applications using only valid, stolen credentials, without requiring additional authentication factors.T1078, T1078.004
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Okta AiTM Session Cookie Replay source high: Detects potential Adversary-in-the-Middle (AiTM) session cookie replay attacks against Okta. This rule identifies when an Okta session is used from multiple IP addresses or with suspicious non-browser user agents after initial authentication. AiTM attacks capture session cookies via phishing proxies (e.g., Evilginx, Modlishka) and replay them from attacker infrastructure, bypassing MFA. The detection correlates session start events with subsequent policy evaluations or SSO attempts that occur from different IPs or programmatic user agents.T1539, T1550, T1550.004↳ also matches user.session.start

Show 12 more (15 total) on the rules page

Splunk #

Okta Multiple Failed Requests to Access Applications source: The following analytic detects multiple failed attempts to access applications in Okta, potentially indicating the reuse of a stolen web session cookie. It leverages Okta logs to evaluate policy and SSO events, aggregating data by user,…T1538, T1550, T1550.004

YARA-L #

Okta Multiple Failed Requests To Access Applications source medium: Detects multiple failed requests to access applicationsT1550

Panther #

Okta Potentially Stolen Session source high: This rule looks for the same session being used from two devices, indicating a compromised session token.T1539↳ also matches user.session.start
SIGNAL - Okta SSO to AWS source informational
Okta SWA Bulk Access, New Source, and Credential Extraction - Behavioral source high linked query: Query.Okta.SWABulkAccessBehavioral: Detects Okta SWA (Secure Web Authentication) bulk credential extraction, abuse, and access from previously unseen IP addresses or user agents using behavioral z-score and source novelty analysis. SWA apps store credentials in Okta's encrypted vault. Admin accounts with SWA access can view or rotate credentials for users across many apps. This detection builds a 90-day behavioral baseline for each admin's SWA access, credential change patterns, and known source IPs/user agents, then identifies anomalous spikes or new sources in the last 7 days. Detection Logic: - Z-score: SWA authentication volume spike (> 3σ above baseline) - Z-score: Unique SWA app diversity spike (many different apps accessed in one hour) (> 3σ) - Z-score: Credential extraction volume spike (> 3σ) - Z-score: Victim diversity spike (credential changes across many users) (> 2σ) - Cold-start: First-time bulk SWA access (>= 10 events, no prior baseline) - Cold-start: First-time credential extraction (>= 5 extractions, no prior baseline) - New source: SWA access from IP address not seen in 90-day baseline - New source: SWA access from user agent not seen in 90-day baseline - Critical compound: New IP + any credential extraction events Why This Matters: SWA credential extraction is a powerful lateral movement technique. An attacker with admin access can silently retrieve plaintext credentials for hundreds of SWA-protected applications without triggering MFA or generating obvious authentication failures. New source detection catches the initial access phase when a compromised admin account is used from an unfamiliar device or location. Complementary Detection: Use alongside Okta.SWA.OffHoursAccess.Behavioral which detects the same attack vector occurring outside normal business hours.T1078, T1213, T1555

Show 1 more (4 total) on the rules page

References #

user.authentication.universal_logout

Description

This event is fired when an admin or system account triggers Universal Logout against an app instance. It contains the app instance details for which the Universal Logout API was fired. This event identifies when applications have had Universal Logout triggered for audit or debugging purposes. This event is only fired once. It's only fired for applications that have been configured for Universal Logout. You can configure it under Risk policy, Post Auth Session policy, or in an admin-initiated Clear User Session.

Example System Log Event #

{
  "published": 1782417655119,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000130",
  "actor": {
    "id": "00u00000000000000332",
    "type": "User",
    "alternateId": "user73@dw-harness.example",
    "displayName": "DW Harness 114",
    "detailEntry": {
      "realmId": "guo00000000000000062"
    }
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000333",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": {
        "realmId": "guo00000000000000062"
      }
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": []
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.authentication.universal_logout",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "JOB",
    "id": "rsu00000000000000334",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000131",
      "appInstanceIds": []
    }
  },
  "displayMessage": "Universal Logout",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000335",
    "externalSessionId": "trs00000000000000336"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

user.authentication.universal_logout.scheduled

Description

This event is fired when an admin manually triggers Universal Logout for a user. It contains context about the initiating request, such as where the request originated and how the Universal Logout endpoint was invoked. After Universal Logout is complete, the user.authentication.universal_logout event is fired, and you can correlate both events using the traceID. This event identifies the geolocation, IP address, and IP chain of the requesting entity. This event is only fired once. You can correlate this event with the user.authentication.universal_logout event using traceID.

Example System Log Event #

{
  "published": 1782417654400,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000132",
  "actor": {
    "id": "00u00000000000000332",
    "type": "User",
    "alternateId": "user73@dw-harness.example",
    "displayName": "DW Harness 114",
    "detailEntry": {
      "realmId": "guo00000000000000062"
    }
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
      "os": "Windows 11",
      "browser": "CHROME"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.5",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000333",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": {
        "realmId": "guo00000000000000062"
      }
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.5",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.authentication.universal_logout.scheduled",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000067",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000131",
      "behaviors": "{New Geo-Location=BAD_REQUEST, New Device=BAD_REQUEST, New ASN=BAD_REQUEST, New IP=NEGATIVE, New State=BAD_REQUEST, New Country=BAD_REQUEST, Velocity=BAD_REQUEST, New City=BAD_REQUEST}",
      "requestId": "00000000000000000000000000000067",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000025",
      "origin": "https://app.example.com App app.example.com",
      "risk": "{reasons=Anomalous Location, level=MEDIUM}",
      "requestUri": "/oauth2/v1/global-token-revocation",
      "url": "/oauth2/v1/global-token-revocation?"
    }
  },
  "displayMessage": "Universal Logout scheduled",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "MEDIUM",
      "reasons": [
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000155",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000156",
        "result": "NEGATIVE"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000157",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000158",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000159",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000160",
        "result": "BAD_REQUEST"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000161",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000162",
        "result": "BAD_REQUEST"
      }
    ]
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000335",
    "externalSessionId": "10200000000000000335"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more
Potential Okta Brute Force (Device Token Rotation) source low prefix: Detects potential brute force attacks against a single Okta user account where excessive unique device token hashes are generated, indicating automated tooling that fails to persist browser cookies between attempts.T1110, T1110.001↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 7 more (10 total) on the rules page

References #

user.authentication.verify

Description

Verify user identity.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000147",
    "type": "User",
    "alternateId": "user39@dw-harness.example",
    "displayName": "DW Harness 64",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000148",
    "externalSessionId": "10200000000000000148"
  },
  "displayMessage": "Verify user identity",
  "eventType": "user.authentication.verify",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-26T00:41:14.179Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "authnRequestId": "00000000000000000000000000000128",
      "requestId": "00000000000000000000000000000128",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000006",
      "requestUri": "/api/v1/authn",
      "threatSuspected": "false",
      "url": "/api/v1/authn?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000128",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000163",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": null
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType` (elastic rule field)	eq	`user.authentication.auth_via_mfa`	2 rules	elastic
`okta::eventType` (elastic rule field)	eq	`user.mfa.okta_verify.deny_push`	2 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.auth_via_mfa`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.sso`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.verify`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.session.start`	3 rules	elastic
`okta::debugContext.debugData.factor` (elastic rule field)	eq	`OKTA_VERIFY_PUSH`	2 rules	elastic
`okta::outcome.reason` (elastic rule field)	eq	`INVALID_CREDENTIALS`	2 rules	elastic
`okta::outcome.result` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`okta::securityContext.isProxy` (elastic rule field)	eq	`true`	2 rules	elastic
`action` (splunk rule field)	eq	`success`	1 rule	splunk
`eventType` (splunk rule field)	eq	`user.authentication.auth_via_mfa`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy source medium prefix: Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.T1078, T1078.004, T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 13 more
Okta Multiple OS Names Detected for a Single DT Hash source high: Identifies when a single Okta device token hash (dt_hash) is associated with multiple operating system types. This is highly anomalous because a device token is tied to a specific device and its operating system. This alert strongly indicates that an attacker has stolen a device token and is using it to impersonate a legitimate user from a different machine.T1539↳ also matches user.authentication.auth_via_mfa
Multiple Okta User Authentication Events with Same Device Token Hash source low prefix: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 11 more (14 total) on the rules page

Splunk #

Okta Successful Single Factor Authentication source: The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful…T1078, T1078.004, T1586, T1586.003, T1621↳ also matches user.authentication.auth_via_mfa

References #

Okta Event Types Catalog: user.authentication.verify

user.behavior.profile.reset

Description

User behavior profile reset. This event can be used to identify resets to a user behavior profiles, which may be helpful when troubleshooting unexpected behavior detection evaluations. This event is triggered when an administrator manually resets a user's behavior profile in the Admin Console.

References #

Okta Event Types Catalog: user.behavior.profile.reset

user.credential.enroll

Description

Device Trust certificate enrollment.

References #

Okta Event Types Catalog: user.credential.enroll

user.device_session.end

Description

User ended a device session. This event is fired when a user logs out or locks their desktop. This may be useful to audit when the lifecycle of a given device session has ended.

Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.

References #

Okta Event Types Catalog: user.device_session.end

user.device_session.start

Description

User established a device session. This event may be used to identify users which are using Device-Bound SSO. This may be useful to audit when a user established their device session, either at desktop logon or after a successful authentication in the browser. After the device session is established, the resultant deviceSessionId will appear in the authenticationContext of events fired where the device session was used.

Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.

References #

Okta Event Types Catalog: user.device_session.start

user.identity_snapshot.attestation.create

Description

Create identity snapshot attestation for a user. This event can be used by administrators to audit identity snapshot attestations minted for a user. The user and the application are in the event, signifying which user the attestation token is being minted for, and which application is requesting it.

References #

Okta Event Types Catalog: user.identity_snapshot.attestation.create

user.identity_verification

Description

This event is fired when a user is directed to complete an Identity Verification as a result of an Okta Account Management (OAMP) Policy evaluation. This event indicates an identity verification request has occurred and will contain the results of the id verification. Completion of an id verification will determine whether the trigger OAMP operation can be completed; start is recorded by user.identity_verification.start.

References #

Okta Event Types Catalog: user.identity_verification

user.identity_verification.start

Description

An Okta account management policy (OAMP) prompted the user to verify their identity with an identity verification service. Helps admins audit identity-verification prompts and troubleshoot IDV-flow issues. Initiates the prompt for identity-verification flow; completion is recorded by user.identity_verification event.

References #

Okta Event Types Catalog: user.identity_verification.start

user.import.password

Description

Imported user password from external system during login. This can be used to understand if a user password import attempt was successful or if it failed. If the attempt failed, the password import will be tried again on a subsequent successful login. When fired, this event contains information about the import type, and whether or not the password import was successful. If the import is successful, it is safe to "clean up" that user from an external system. If the import failed, Okta will continue retrying the import during every successful authentication attempt until the password is successfully imported. Check the failure reason for details about whether any action is needed for the import to succeed.

References #

Okta Event Types Catalog: user.import.password

user.lifecycle.activate

Description

Activate Okta user.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000123",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Activate Okta user",
  "eventType": "user.lifecycle.activate",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.164Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users",
      "url": "/api/v1/users?activate=true"
    }
  },
  "legacyEventType": "core.user.config.user_activated",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (sigma rule field)	eq	`user.lifecycle.create`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta 2023 Breach Indicator Of Compromise source medium: Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.↳ also matches user.lifecycle.create

References #

Okta Event Types Catalog: user.lifecycle.activate

user.lifecycle.create

Description

Create Okta user.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000123",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Create okta user",
  "eventType": "user.lifecycle.create",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.047Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users",
      "url": "/api/v1/users?activate=true"
    }
  },
  "legacyEventType": "core.user.config.user_creation.success",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (sigma rule field)	eq	`user.lifecycle.create`	2 rules	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

New Okta User Created source informational: Detects new user account creation
Okta 2023 Breach Indicator Of Compromise source medium: Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.↳ also matches user.lifecycle.activate

References #

Okta Event Types Catalog: user.lifecycle.create

user.lifecycle.deactivate

Description

Deactivate Okta user.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000124",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Deactivate Okta User",
  "eventType": "user.lifecycle.deactivate",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.506Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000011/lifecycle/deactivate",
      "url": "/api/v1/users/00u00000000000000011/lifecycle/deactivate?"
    }
  },
  "legacyEventType": "core.user.config.user_deactivated",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.lifecycle.deactivate

user.lifecycle.delete.completed

Description

Delete Okta user completed.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000008",
    "externalSessionId": "trs00000000000000008"
  },
  "displayMessage": "Delete Okta user completed",
  "eventType": "user.lifecycle.delete.completed",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-25T23:17:38.037Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000005",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "requestUri": "/api/v1/users/00u00000000000000007",
      "url": "/api/v1/users/00u00000000000000007?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.user.config.user_status.delete.completed",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000005",
    "detail": {
      "rootApiTokenId": "00T00000000000000004",
      "requestApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000010",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00u00000000000000007",
      "type": "User",
      "alternateId": "user04@dw-harness.example",
      "displayName": "DW Harness 03",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.lifecycle.delete.completed

user.lifecycle.delete.initiated

Description

Delete Okta user initiated.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000125",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Delete Okta user initiated",
  "eventType": "user.lifecycle.delete.initiated",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.621Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000011",
      "url": "/api/v1/users/00u00000000000000011?"
    }
  },
  "legacyEventType": "core.user.config.user_status.delete.initiated",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.lifecycle.delete.initiated

user.lifecycle.jit.error.read_only

Description

Failed to JIT create user.

References #

Okta Event Types Catalog: user.lifecycle.jit.error.read_only

user.lifecycle.password_mass_expiry

Description

Mass expire all users' passwords initiated.

References #

Okta Event Types Catalog: user.lifecycle.password_mass_expiry

user.lifecycle.reactivate

Description

Reactivate Okta user.

References #

Okta Event Types Catalog: user.lifecycle.reactivate

user.lifecycle.suspend

Description

Suspend Okta user.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000126",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Suspend Okta user",
  "eventType": "user.lifecycle.suspend",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:58.217Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000023/lifecycle/suspend",
      "url": "/api/v1/users/00u00000000000000023/lifecycle/suspend?"
    }
  },
  "legacyEventType": "core.user.config.user_status.suspended",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.lifecycle.suspend

user.lifecycle.unsuspend

Description

Unsuspend Okta user.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000127",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Unsuspend Okta user",
  "eventType": "user.lifecycle.unsuspend",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:58.348Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000023/lifecycle/unsuspend",
      "url": "/api/v1/users/00u00000000000000023/lifecycle/unsuspend?"
    }
  },
  "legacyEventType": "core.user.config.user_status.unsuspended",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.lifecycle.unsuspend

user.mfa.attempt_bypass

Description

Attempt bypass of factor.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (panther rule field)	in	`user.account.reset_password`	1 rule	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Attempted Bypass of Okta MFA source high: Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.T1111

Kusto #

New Device/Location sign-in along with critical operation source medium: This query identifies users seen login from a new geo location/country and a new device, then correlates that sign-in with successful risky operations such as policy changes, MFA changes, API token actions etc. This can be an indication of an attacker gaining access to a user's credentials and then performing critical operations, which typically requires admin privileges. By detecting such patterns, organizations can quickly respond to potential security incidents and mitigate risks associated with unauthorized access and privilege escalation.T1078, T1098, T1556↳ also matches user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.session.start

Panther #

Okta Support Reset Credential source high: A Password or MFA factor was reset by Okta SupportT1199↳ also matches user.account.reset_password, user.mfa.factor.update

References #

Okta Event Types Catalog: user.mfa.attempt_bypass

user.mfa.factor.activate

Description

Activate factor or authenticator enrollment method for user. Provides org admins with audit log and oversight utility for an MFA factor when it is activated. When fired, the event contains information about the MFA factor that has been activated, as well as the target user and the user activating the factor. For Identity Engine orgs, this event will fire when an authentication method is enrolled.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000123",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Activate factor for user",
  "eventType": "user.mfa.factor.activate",
  "outcome": {
    "result": "SUCCESS",
    "reason": "User set up EMAIL_FACTOR factor"
  },
  "published": "2026-07-02T18:35:49.039Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000000",
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users",
      "url": "/api/v1/users?activate=true"
    }
  },
  "legacyEventType": "core.user.factor.activate",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`admin_email` (panther rule field)	is_not_null		1 rule	panther
`is_anomalous` (panther rule field)	eq	`true`	1 rule	panther
`okta::eventType` (elastic rule field)	in	`user.mfa.factor.deactivate`	1 rule	elastic
`okta::eventType` (elastic rule field)	in	`user.mfa.factor.reset_all`	1 rule	elastic
`okta::outcome.result` (elastic rule field)	eq	`SUCCESS`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

MFA Deactivation with no Re-Activation for Okta User Account source low: Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.T1556, T1556.006↳ also matches user.mfa.factor.deactivate, user.mfa.factor.reset_all

Panther #

Okta Authentication Bypass via Skeleton Key Injection - Behavioral source high linked query: Query.Okta.SkeletonKeyBypassBehavioral: Detects potential Okta authentication bypass via skeleton key injection using behavioral z-score analysis. Skeleton key attacks in Okta involve manipulating authentication policies to weaken MFA requirements (disabling requireFactor, zeroing maxSessionLifetime) and bulk-enrolling attacker-controlled authenticators on victim accounts. This detection builds a 90-day behavioral baseline for each admin's policy change and factor enrollment patterns, then identifies anomalous spikes in the last 7 days. Detection Logic: - Z-score: Spike in security-weakening policy changes (> 2σ above baseline) - Z-score: Spike in admin-on-behalf-of MFA factor enrollments (> 3σ above baseline) - Cold-start: First-time security weakening (no prior baseline - immediate high-confidence signal) - Cold-start: First-time admin-enrolled factors for other users Why This Matters: Skeleton key attacks require two steps: weaken authentication policies to reduce MFA friction, then enroll attacker-controlled authenticators on victim accounts. This detection catches both steps using behavioral baselines that adapt to legitimate admin workflows. Complementary Detection: Use alongside Okta.ADAgent.TokenAbuse.Behavioral for admin credential theft scenarios.T1098, T1556
Query.Okta.SkeletonKeyBypassBehavioral source: Detects Okta authentication bypass attempts via skeleton key injection using behavioral z-score analysis. Reads pre-computed 90-day baselines from the okta_baseline_90d lookup table, then compares recent (last 7 days) admin policy change and MFA factor enrollment patterns against those baselines. DETECTION LOGIC: - Z-score: Security-weakening policy changes (requireFactor=false, maxSessionLifetime=0) > 2σ - Z-score: Admin-on-behalf-of MFA factor enrollments for other users > 3σ - Cold-start: First-time security weakening with no prior baseline - Cold-start: First-time admin-enrolled factors for other users PREREQUISITE: okta_baseline_90d lookup table must be populated.

References #

Okta Event Types Catalog: user.mfa.factor.activate

user.mfa.factor.deactivate

Description

Reset factor or authenticator enrollment method for user. Provides org admins with audit log and oversight utility for the change in MFA factor lifecycle status when a specific factor is permanently deactivated. When fired, the event contains information about the MFA factor that has been deactivated, as well as the target user and the user deactivating the factor. For Identity Engine orgs, this event will fire when an authentication method is unenrolled.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000152",
    "externalSessionId": "0000000000000000000000069"
  },
  "displayMessage": "Reset factor for user",
  "eventType": "user.mfa.factor.deactivate",
  "outcome": {
    "result": "SUCCESS",
    "reason": "User reset OKTA_SOFT_TOKEN factor"
  },
  "published": "2026-07-26T00:47:27.258Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000130",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "requestUri": "/api/v1/users/00u00000000000000150/factors/ost00000000000000151",
      "url": "/api/v1/users/00u00000000000000150/factors/ost00000000000000151?"
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.user.factor.deactivate",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000130",
    "detail": {
      "rootApiTokenId": "00T00000000000000004"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000166",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00u00000000000000150",
      "type": "User",
      "alternateId": "user40@dw-harness.example",
      "displayName": "DW Harness 60",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType`	in	`user.mfa.factor.deactivate`	2 rules	elastic, kusto
`okta::eventType`	in	`user.mfa.factor.reset_all`	2 rules	elastic, kusto
`okta::outcome.result`	eq	`SUCCESS`	2 rules	elastic, kusto
`All_Changes.action` (splunk rule field)	eq	`modified`	1 rule	splunk
`All_Changes.object_category` (splunk rule field)	eq	`user`	1 rule	splunk
`eventType` (panther rule field)	in	`user.account.reset_password`	1 rule	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta MFA Reset or Deactivated source medium: Detects when an attempt at deactivating or resetting MFA.T1556, T1556.006↳ also matches user.mfa.factor.reset_all

Elastic #

MFA Deactivation with no Re-Activation for Okta User Account source low: Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.T1556, T1556.006↳ also matches user.mfa.factor.activate, user.mfa.factor.reset_all

Splunk #

Okta Multi-Factor Authentication Disabled source: The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because…T1556, T1556.006

Kusto #

New Device/Location sign-in along with critical operation source medium: This query identifies users seen login from a new geo location/country and a new device, then correlates that sign-in with successful risky operations such as policy changes, MFA changes, API token actions etc. This can be an indication of an attacker gaining access to a user's credentials and then performing critical operations, which typically requires admin privileges. By detecting such patterns, organizations can quickly respond to potential security incidents and mitigate risks associated with unauthorized access and privilege escalation.T1078, T1098, T1556↳ also matches user.mfa.attempt_bypass, user.mfa.factor.reset_all, user.session.start

YARA-L #

Okta User Password and MFA Factor Reset or Deactivated source medium: Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.T1556↳ also matches user.account.reset_password, user.mfa.factor.reset_all

Panther #

Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.reset_password, user.account.update_password, user.mfa.factor.reset_all, user.mfa.factor.suspend, user.mfa.factor.update

References #

Okta Event Types Catalog: user.mfa.factor.deactivate

user.mfa.factor.reset_all

Description

Reset all factors or authenticator enrollments for user. Provides org admins with audit log and oversight utility for the change in MFA factor lifecycle statuses when all MFA factors for a user are permanently deactivated. When fired, the event contains information about the target user for whom all factors have been deactivated, as well as the user resetting the factors. For Identity Engine orgs, this event contains information about a target user for whom all authenticator enrollments have been reset.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000130",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Reset all factors for user",
  "eventType": "user.mfa.factor.reset_all",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:57.859Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000023/lifecycle/reset_factors",
      "url": "/api/v1/users/00u00000000000000023/lifecycle/reset_factors?"
    }
  },
  "legacyEventType": "core.user.factor.reset_all",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType`	in	`user.mfa.factor.deactivate`	2 rules	elastic, kusto
`okta::eventType`	in	`user.mfa.factor.reset_all`	2 rules	elastic, kusto
`okta::outcome.result`	eq	`SUCCESS`	2 rules	elastic, kusto
`eventType` (panther rule field)	in	`user.account.reset_password`	1 rule	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta MFA Reset or Deactivated source medium: Detects when an attempt at deactivating or resetting MFA.T1556, T1556.006↳ also matches user.mfa.factor.deactivate

Elastic #

Attempt to Reset MFA Factors for an Okta User Account source low: Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.T1098, T1556, T1556.006
MFA Deactivation with no Re-Activation for Okta User Account source low: Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.T1556, T1556.006↳ also matches user.mfa.factor.activate, user.mfa.factor.deactivate

Kusto #

New Device/Location sign-in along with critical operation source medium: This query identifies users seen login from a new geo location/country and a new device, then correlates that sign-in with successful risky operations such as policy changes, MFA changes, API token actions etc. This can be an indication of an attacker gaining access to a user's credentials and then performing critical operations, which typically requires admin privileges. By detecting such patterns, organizations can quickly respond to potential security incidents and mitigate risks associated with unauthorized access and privilege escalation.T1078, T1098, T1556↳ also matches user.mfa.attempt_bypass, user.mfa.factor.deactivate, user.session.start

YARA-L #

Okta User Password and MFA Factor Reset or Deactivated source medium: Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.T1556↳ also matches user.account.reset_password, user.mfa.factor.deactivate

Panther #

Okta User MFA Reset All source low: All MFA factors have been reset for a user.
Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.reset_password, user.account.update_password, user.mfa.factor.deactivate, user.mfa.factor.suspend, user.mfa.factor.update

References #

Okta Event Types Catalog: user.mfa.factor.reset_all

user.mfa.factor.suspend

Description

Suspend factor or authenticator enrollment method for user. Provides org admins with audit log and oversight utility for the change in MFA factor lifecycle status when a factor is suspended, usually as a result of suspected compromise. When fired, the event contains information about the MFA factor that has been suspended, as well as the target user and the user suspending the factor. When unsuspended, related event user.mfa.factor.unsuspend will be fired.

Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.

Example System Log Event #

{
  "published": 1782423539742,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000133",
  "actor": {
    "id": "00u00000000000000332",
    "type": "User",
    "alternateId": "user73@dw-harness.example",
    "displayName": "DW Harness 114",
    "detailEntry": {
      "realmId": "guo00000000000000062"
    }
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
      "os": "Windows 11",
      "browser": "CHROME"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.5",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000333",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": {
        "realmId": "guo00000000000000062"
      }
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": "User suspended SIGNED_NONCE factor"
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.5",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.mfa.factor.suspend",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000068",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "behaviors": "{New Geo-Location=BAD_REQUEST, New Device=BAD_REQUEST, New ASN=BAD_REQUEST, New IP=NEGATIVE, New State=BAD_REQUEST, New Country=BAD_REQUEST, Velocity=BAD_REQUEST, New City=BAD_REQUEST}",
      "requestId": "00000000000000000000000000000068",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000025",
      "origin": "https://app.example.com App app.example.com",
      "risk": "{reasons=Anomalous Location, level=MEDIUM}",
      "requestUri": "000000000000000000000000000000000000000000000000000002",
      "url": "000000000000000000000000000000000000000000000000000002?"
    }
  },
  "displayMessage": "Suspend factor for Example App 61",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "MEDIUM",
      "reasons": [
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000155",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000156",
        "result": "NEGATIVE"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000157",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000158",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000159",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000160",
        "result": "BAD_REQUEST"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000161",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000162",
        "result": "BAD_REQUEST"
      }
    ]
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000337",
    "externalSessionId": "10200000000000000337"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (panther rule field)	in	`user.account.reset_password`	1 rule	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	1 rule	panther
`okta::eventType` (kusto rule field)	in	`system.api_token.create`	1 rule	kusto
`outcome.result` (panther rule field)	eq	`SUCCESS`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Admin Activity source medium: The Okta risk engine auto-assigns risk levels to each login attempt. This rule identifies successful admin operations that correlate with successful high-risk Okta authentication or session start events.T1078, T1078.004, T1098↳ also matches user.account.privilege.grant, user.session.access_admin_app, user.session.impersonation.grant, user.session.start

Panther #

Okta User MFA Factor Suspend source high: Suspend factor or authenticator enrollment method for user.
Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.reset_password, user.account.update_password, user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.mfa.factor.update

References #

user.mfa.factor.unsuspend

Description

Unsuspend factor or authenticator enrollment method for user. Provides org admins with audit log and oversight utility for the change in MFA factor lifecycle status when a factor is reactivated from a state of suspension, after it has been determined that the authenticator is secure. When fired, the event contains information about the MFA factor that has been unsuspended, as well as the target user and the user reactivating the suspended factor. Before suspension, related event user.mfa.factor.suspend would have been fired.

Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.

Example System Log Event #

{
  "published": 1782423542964,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000134",
  "actor": {
    "id": "00u00000000000000332",
    "type": "User",
    "alternateId": "user73@dw-harness.example",
    "displayName": "DW Harness 114",
    "detailEntry": {
      "realmId": "guo00000000000000062"
    }
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
      "os": "Windows 11",
      "browser": "CHROME"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.5",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000333",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": {
        "realmId": "guo00000000000000062"
      }
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": "User unsuspended SIGNED_NONCE factor"
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.5",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.mfa.factor.unsuspend",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000069",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "behaviors": "{New Geo-Location=BAD_REQUEST, New Device=BAD_REQUEST, New ASN=BAD_REQUEST, New IP=NEGATIVE, New State=BAD_REQUEST, New Country=BAD_REQUEST, Velocity=BAD_REQUEST, New City=BAD_REQUEST}",
      "requestId": "00000000000000000000000000000069",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000025",
      "origin": "https://app.example.com App app.example.com",
      "risk": "{reasons=Anomalous Location, level=MEDIUM}",
      "requestUri": "00000000000000000000000000000000000000000000000000000002",
      "url": "00000000000000000000000000000000000000000000000000000002?"
    }
  },
  "displayMessage": "Unsuspend factor for Example App 61",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "MEDIUM",
      "reasons": [
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000155",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000156",
        "result": "NEGATIVE"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000157",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000158",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000159",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000160",
        "result": "BAD_REQUEST"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000161",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000162",
        "result": "BAD_REQUEST"
      }
    ]
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000337",
    "externalSessionId": "10200000000000000337"
  }
}

References #

user.mfa.factor.update

Description

Update factor for user.

Example System Log Event #

{
  "published": 1780124575422,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000135",
  "actor": {
    "id": "00u00000000000000338",
    "type": "User",
    "alternateId": "user74@dw-harness.example",
    "displayName": "DW Harness 115",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "app.example.com.android.auth/8.26.0 Android/16 motorola/motorola_edge_plus_2023 7cs00000000000000339",
      "os": "Android",
      "browser": "EDGE"
    },
    "zone": "null",
    "device": "Mobile",
    "id": null,
    "ipAddress": "192.0.2.37",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000338",
      "type": "User",
      "alternateId": "user74@dw-harness.example",
      "displayName": "DW Harness 115",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": "User updated OKTA_VERIFY_PUSH factor"
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.37",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.mfa.factor.update",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000070",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000070",
      "requestUri": "000000000000000000000000000000000000000000004",
      "url": "000000000000000000000000000000000000000000004?"
    }
  },
  "displayMessage": "Update factor for Example App 61",
  "gatewayContext": null,
  "legacyEventType": "core.user.factor.update",
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000340",
    "externalSessionId": "trs00000000000000340"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`eventType` (panther rule field)	in	`user.account.reset_password`	2 rules	panther
`eventType` (panther rule field)	in	`user.mfa.factor.update`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Stolen Credentials Used to Login to Okta Account After MFA Reset source high: Detects a sequence of suspicious activities on Windows hosts indicative of credential compromise, followed by efforts to undermine multi-factor authentication (MFA) and single sign-on (SSO) mechanisms for an Okta user account.T1556, T1556.006↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 15 more

Panther #

Okta Support Reset Credential source high: A Password or MFA factor was reset by Okta SupportT1199↳ also matches user.account.reset_password, user.mfa.attempt_bypass
Okta Investigate MFA and Password resets source: Investigate Password and MFA resets for the last 7 days↳ also matches user.account.reset_password, user.account.update_password, user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.mfa.factor.suspend

References #

user.mfa.okta_verify

Description

Verify user with Okta verify.

References #

Okta Event Types Catalog: user.mfa.okta_verify

user.mfa.okta_verify.deny_push

Description

User rejected Okta push verify. This event is triggered in classic V1 API calls. In OIE we use a generic event for factor verification failure: user.authentication.auth_via_mfa with reason INVALID_CREDENTIALS.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType`	eq	`user.authentication.auth_via_mfa`	3 rules	elastic, kusto
`okta::eventType`	eq	`user.mfa.okta_verify.deny_push`	3 rules	elastic, kusto
`okta::eventType` (elastic rule field)	in	`user.authentication.auth_via_mfa`	2 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.sso`	2 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.verify`	2 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.session.start`	2 rules	elastic
`okta::debugContext.debugData.factor` (elastic rule field)	eq	`OKTA_VERIFY_PUSH`	2 rules	elastic
`okta::outcome.reason` (elastic rule field)	eq	`INVALID_CREDENTIALS`	2 rules	elastic
`okta::outcome.result` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`security_result.detection_fields["factor"] (Chronicle)`	eq	`OKTA_VERIFY_PUSH`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Potential Okta MFA Bombing via Push Notifications source high: Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.T1078, T1078.004, T1621↳ also matches user.authentication.auth_via_mfa, user.authentication.sso, user.authentication.verify, user.session.start
Potentially Successful Okta MFA Bombing via Push Notifications source high: Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.T1078, T1078.004, T1621↳ also matches user.authentication.auth_via_mfa, user.authentication.sso, user.authentication.verify, user.session.start

Kusto #

MFA Fatigue (OKTA) source medium: MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into approving multi-factor authentication prompts, potentially compromising their own security. The query identifies MFA fatigue attempts in Okta by correlating repeated Okta Verify push requests, denied pushes, and eventual successful MFA authentication within the same session. Ref: https://www.okta.com/blog/identity-security/mfa-fatigue-growing-security-concern/.T1621↳ also matches user.authentication.auth_via_mfa

YARA-L #

Okta User Rejected Multiple Push Notifications source medium: Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.T1110↳ also matches user.authentication.auth_via_mfa

References #

Okta Event Types Catalog: user.mfa.okta_verify.deny_push

user.mfa.okta_verify.deny_push_upgrade_needed

Description

Rejected Okta push verify as Upgrade Needed. This can be used to audit events where Okta push verify was rejected as the app needed upgrade. Note that the event is fired when Okta Verify push is rejected. It is possible that the user might have chosen another factor and made successful login as well.

References #

Okta Event Types Catalog: user.mfa.okta_verify.deny_push_upgrade_needed

user.risk.change

Description

Indicates a user's risk level has changed. This event can be used to monitor risk level changes for users. This event triggers when Okta determines that a user is associated with a change in risk activity or context.

References #

Okta Event Types Catalog: user.risk.change

user.risk.detect

Description

Indicates a user risk was detected. This event can be used to monitor risk level detections for users. This event triggers when Okta detects that a user is associated with risk activity or context.

Example System Log Event #

{
  "published": 1782417655134,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000136",
  "actor": {
    "id": "spr00000000000000167",
    "type": "SystemPrincipal",
    "alternateId": "user41@dw-harness.example",
    "displayName": "Okta System",
    "detailEntry": null
  },
  "client": {
    "userAgent": null,
    "zone": null,
    "device": null,
    "id": null,
    "ipAddress": null,
    "geographicalContext": null
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000333",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": {
        "realmId": "guo00000000000000062"
      }
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": []
  },
  "version": "0",
  "severity": "WARN",
  "eventType": "user.risk.detect",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "JOB",
    "id": "rsu00000000000000334",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000131",
      "risk": "{previousLevel=NONE, level=LOW, detectionName=Admin Mitigated User Risk, reasons=Universal app logout cleared all Example App 61 sessions, issuer=OKTA}"
    }
  },
  "displayMessage": "User risk was detected",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "isp": null,
    "domain": null,
    "isProxy": null,
    "risk": {
      "level": "LOW",
      "reasons": [
        "Universal app logout cleared all user sessions"
      ],
      "previousLevel": "NONE",
      "detectionName": "Admin Mitigated User Risk",
      "issuer": "OKTA"
    }
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000335",
    "externalSessionId": "trs00000000000000336"
  }
}

References #

user.session.access_admin_app

Description

User accessing Okta admin app.

Example System Log Event #

{
  "published": 1780234878322,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000137",
  "actor": {
    "id": "00u00000000000000179",
    "type": "User",
    "alternateId": "user44@dw-harness.example",
    "displayName": "DW Harness 59",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36",
      "os": "Mac OS X",
      "browser": "CHROME"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.21",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000179",
      "type": "AppUser",
      "alternateId": "user44@dw-harness.example",
      "displayName": "DW Harness 59",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.21",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.session.access_admin_app",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000071",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000138",
      "requestId": "00000000000000000000000000000071",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000022",
      "idpType": "OKTA",
      "requestUri": "/admin/sso/callback",
      "threatSuspected": "false",
      "url": "/admin/sso/callback?code=******&state=00000000000000000000000000000072"
    }
  },
  "displayMessage": "User accessing Okta admin app",
  "gatewayContext": null,
  "legacyEventType": "app.admin.sso.login.success",
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "idx00000000000000341",
    "externalSessionId": "10200000000000000342"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Admin Activity source medium: The Okta risk engine auto-assigns risk levels to each login attempt. This rule identifies successful admin operations that correlate with successful high-risk Okta authentication or session start events.T1078, T1078.004, T1098↳ also matches user.account.privilege.grant, user.mfa.factor.suspend, user.session.impersonation.grant, user.session.start

References #

user.session.clear

Description

Clear user session.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000124",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Clear user session",
  "eventType": "user.session.clear",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:35:49.526Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/users/00u00000000000000011/lifecycle/deactivate",
      "url": "/api/v1/users/00u00000000000000011/lifecycle/deactivate?"
    }
  },
  "legacyEventType": "core.user_auth.session_clear",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "User",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: user.session.clear

user.session.context.change

Description

User session context changed. This event indicates that the context in which the session is being used has changed significantly enough from the context in which the event was created, that re-evaluation of policy may be required. Often this indicates a security issue related to the session.

Example System Log Event #

{
  "published": 1781352320466,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000139",
  "actor": {
    "id": "spr00000000000000171",
    "type": "SystemPrincipal",
    "alternateId": "user41@dw-harness.example",
    "displayName": "Okta System",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "OktaVerify/6.10.2.0 WPFDeviceSDK/6.10.2.0 Windows/10.0.26200.8655 Dell_Inc./Dell_Pro_Max_16_MC16250 1ef1f27b-0039-4c03-8c54-be987e",
      "os": "Windows",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.38",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000343",
      "type": "User",
      "alternateId": "user75@dw-harness.example",
      "displayName": "DW Harness 116",
      "detailEntry": {
        "realmId": "guo00000000000000044"
      }
    },
    {
      "id": "guo00000000000000344",
      "type": "UDDevice",
      "alternateId": "user06@dw-harness.example",
      "displayName": "DW Harness 71",
      "detailEntry": null
    },
    {
      "id": "idx00000000000000345",
      "type": "Session",
      "alternateId": "user06@dw-harness.example",
      "displayName": "DW Harness 71",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.38",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.session.context.change",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000073",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "traceId": "00000000-0000-0000-0000-000000000140",
      "changedDeviceSignals": {
        "diskEncryptionType": {
          "oldValue": "NONE",
          "newValue": "ALL_INTERNAL_VOLUMES"
        }
      },
      "newIpAddress": "192.0.2.17",
      "previousIpAddress": "192.0.2.17",
      "arePoliciesReevaluated": "true",
      "externalSessionId": "idx00000000000000345",
      "requestUri": "xsl00000000000000346",
      "source": "OKTA",
      "url": "xsl00000000000000346?",
      "requestId": "00000000000000000000000000000073",
      "causes": "[deviceContext.change]",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000032",
      "risk": "{level=LOW}",
      "associatedProxies": [
        "LUMINATI_PROXY"
      ]
    }
  },
  "displayMessage": "User session context changed",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "LOW"
    }
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000003",
    "externalSessionId": "0000003"
  }
}

References #

user.session.end

Description

User logout from Okta.

Example System Log Event #

{
  "actor": {
    "alternateId": "user20@dw-harness.example",
    "detailEntry": null,
    "displayName": "DW Harness 30",
    "id": "00u00000000000000026",
    "type": "User"
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "authenticationStep": 0,
    "credentialProvider": null,
    "credentialType": null,
    "externalSessionId": "0000000000000000000000131",
    "interface": null,
    "issuer": null
  },
  "client": {
    "device": "Computer",
    "geographicalContext": {
      "city": "Anytown",
      "country": "Placeholderland",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      },
      "postalCode": "00000",
      "state": "Anystate"
    },
    "id": null,
    "ipAddress": "198.51.100.14",
    "userAgent": {
      "browser": "FIREFOX",
      "os": "Mac OS X",
      "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"
    },
    "zone": "null"
  },
  "debugContext": {
    "debugData": {
      "authnRequestId": "000000000000000000000000010",
      "requestId": "000000000000000000000000132",
      "requestUri": "/login/signout",
      "threatSuspected": "false",
      "url": "/login/signout?message=login_page_messages.session_has_expired"
    }
  },
  "displayMessage": "User logout from Okta",
  "eventType": "user.session.end",
  "legacyEventType": "core.user_auth.logout_success",
  "outcome": {
    "reason": null,
    "result": "SUCCESS"
  },
  "published": "2020-02-14T22:18:51.843Z",
  "request": {
    "ipChain": [
      {
        "geographicalContext": {
          "city": "Anytown",
          "country": "Placeholderland",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          },
          "postalCode": "00000",
          "state": "Anystate"
        },
        "ip": "198.51.100.14",
        "source": null,
        "version": "V4"
      }
    ]
  },
  "securityContext": {
    "asNumber": null,
    "asOrg": null,
    "domain": null,
    "isProxy": null,
    "isp": null
  },
  "severity": "INFO",
  "target": null,
  "transaction": {
    "detail": {},
    "id": "000000000000000000000000132",
    "type": "WEB"
  },
  "uuid": "00000000-0000-0000-0000-000000000025",
  "version": "0"
}

References #

user.session.expire

Description

Expire user session. This event does not appear in the system logs unless the user explicitly signs out or the user session is revoked by an admin.

References #

Okta Event Types Catalog: user.session.expire

user.session.impersonation.end

Description

End impersonation session.

References #

Okta Event Types Catalog: user.session.impersonation.end

user.session.impersonation.extend

Description

Extend impersonation session.

References #

Okta Event Types Catalog: user.session.impersonation.extend

user.session.impersonation.grant

Description

Enable impersonation grant.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`p_occurs_between` (panther rule field)	macro	`'2022-01-14' , '2022-03-22'`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

High-Risk Admin Activity source medium: The Okta risk engine auto-assigns risk levels to each login attempt. This rule identifies successful admin operations that correlate with successful high-risk Okta authentication or session start events.T1078, T1078.004, T1098↳ also matches user.account.privilege.grant, user.mfa.factor.suspend, user.session.access_admin_app, user.session.start

Panther #

Okta Support Access Granted source medium: An admin user has granted access to Okta Support to your accountT1199↳ also matches user.session.impersonation.initiate
Okta Support Access source: Show instances that Okta support was granted to your account↳ also matches user.session.impersonation.initiate

References #

Okta Event Types Catalog: user.session.impersonation.grant

user.session.impersonation.initiate

Description

Initiate impersonation session.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`p_occurs_between` (panther rule field)	macro	`'2022-01-14' , '2022-03-22'`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Okta User Session Impersonation source high: A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.T1078, T1078.004

Kusto #

User Session Impersonation(Okta) source medium: This query detects instances of user session impersonation, where an attacker successfully initiates a session impersonation event. The query extracts detailed information about the target user and the actor involved in the impersonation, providing insights into potential privilege escalation activities.T1134, T1134.003

Panther #

Okta Support Access Granted source medium: An admin user has granted access to Okta Support to your accountT1199↳ also matches user.session.impersonation.grant
Okta Support Access source: Show instances that Okta support was granted to your account↳ also matches user.session.impersonation.grant

References #

Okta Event Types Catalog: user.session.impersonation.initiate

user.session.impersonation.revoke

Description

Revoke impersonation grant.

References #

Okta Event Types Catalog: user.session.impersonation.revoke

user.session.start

Description

User login to Okta.

Example System Log Event #

{
  "actor": {
    "id": "00u00000000000000147",
    "type": "User",
    "alternateId": "user39@dw-harness.example",
    "displayName": "DW Harness 64",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "198.51.100.2",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000148",
    "externalSessionId": "10200000000000000148"
  },
  "displayMessage": "User login to Okta",
  "eventType": "user.session.start",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-26T00:41:14.122Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "HIGH",
      "reasons": [
        "Anomalous Device",
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000132",
        "result": "UNKNOWN"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000133",
        "result": "UNKNOWN"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000134",
        "result": "UNKNOWN"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000135",
        "result": "UNKNOWN"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000136",
        "result": "UNKNOWN"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000137",
        "result": "UNKNOWN"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000138",
        "result": "UNKNOWN"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000139",
        "result": "UNKNOWN"
      }
    ]
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "00000000000000000000000000000128",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000006",
      "requestUri": "/api/v1/authn",
      "threatSuspected": "false",
      "url": "/api/v1/authn?",
      "logOnlySecurityData": {
        "risk": {
          "reasons": "Anomalous Device, Anomalous Location",
          "level": "HIGH"
        },
        "behaviors": {
          "New Geo-Location": "UNKNOWN",
          "New Device": "UNKNOWN",
          "New ASN": "UNKNOWN",
          "New IP": "UNKNOWN",
          "New State": "UNKNOWN",
          "New Country": "UNKNOWN",
          "Velocity": "UNKNOWN",
          "New City": "UNKNOWN"
        }
      }
    }
  },
  "gatewayContext": null,
  "legacyEventType": "core.user_auth.login_success",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000128",
    "detail": {}
  },
  "uuid": "00000000-0000-0000-0000-000000000162",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "198.51.100.2",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": null
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::actor.alternateId`	is_not_null		7 rules	elastic, kusto
`okta::eventType`	eq	`user.session.start`	5 rules	elastic, kusto
`okta::eventType` (elastic rule field)	eq	`user.authentication.auth_via_mfa`	2 rules	elastic
`okta::eventType` (elastic rule field)	eq	`user.mfa.okta_verify.deny_push`	2 rules	elastic
`okta::eventType`	in	`user.session.start`	5 rules	elastic, kusto
`okta::eventType` (elastic rule field)	in	`user.authentication.sso`	4 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.auth_via_mfa`	3 rules	elastic
`okta::eventType` (elastic rule field)	in	`user.authentication.verify`	3 rules	elastic
`eventType`	eq	`user.session.start`	4 rules	panther, sigma
`okta::outcome.result`	eq	`SUCCESS`	3 rules	elastic, kusto
`okta::outcome.result`	eq	`success`	3 rules	elastic, kusto
`outcome:result` (panther rule field)	eq	`success`	3 rules	panther
`client:device` (panther rule field)	eq	`computer`	2 rules	panther
`client:ipAddress` (panther rule field)	wildcard	`...`	2 rules	panther
`okta::debugContext.debugData.factor` (elastic rule field)	eq	`OKTA_VERIFY_PUSH`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta User Session Start Via An Anonymising Proxy Service source high: Detects when an Okta user session starts where the user is behind an anonymising proxy service.T1685

Elastic #

Multiple Okta Sessions Detected for a Single User source medium: Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location.T1550, T1550.004
Okta AiTM Session Cookie Replay source high: Detects potential Adversary-in-the-Middle (AiTM) session cookie replay attacks against Okta. This rule identifies when an Okta session is used from multiple IP addresses or with suspicious non-browser user agents after initial authentication. AiTM attacks capture session cookies via phishing proxies (e.g., Evilginx, Modlishka) and replay them from attacker infrastructure, bypassing MFA. The detection correlates session start events with subsequent policy evaluations or SSO attempts that occur from different IPs or programmatic user agents.T1539, T1550, T1550.004↳ also matches user.authentication.sso
Multiple Okta User Authentication Events with Same Device Token Hash source low: Detects when a high number of Okta user authentication events are reported for multiple users in a short time frame. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts.T1110, T1110.003, T1110.004↳ also matches user.authentication.auth, user.authentication.auth_identifier_not_in_policy, user.authentication.auth_unconfigured_identifier, user.authentication.auth_via_AD_agent, user.authentication.auth_via_IDP, user.authentication.auth_via_LDAP_agent, and 14 more

Show 11 more (14 total) on the rules page

Splunk #

Okta Multiple Users Failing To Authenticate From Ip source: The following analytic identifies instances where more than 10 unique user accounts have failed to authenticate from a single IP address within a 5-minute window in an Okta tenant. This detection uses OktaIm2 logs ingested via the Splunk…T1110, T1110.003
Okta User Logins from Multiple Cities source: The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their geographic locations. Such…T1586, T1586.003

Kusto #

Failed Logins from Unknown or Invalid User source medium: This rule alerts when an unknown or invalid user generates more than 15 failed Okta management console login attempts from the same IP address within 5 minutes.T1110, T1110.001
User Login from Different Countries within 3 hours source high: This rule detects successful user logins to the Okta Console from different countries within 3 hours. This may indicate a compromised account or an account being used by multiple individuals in different locations.T1078, T1078.004
Potential Password Spray Attack source medium: This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.T1110, T1110.003

Show 2 more (5 total) on the rules page

YARA-L #

Okta Successful High Risk User Logins source medium: Detects successfully authenticated user logins based on Okta's Behavior Detection pattern analysis.T1078
Okta User Logins From Multiple Cities source medium: Detects user logins for same user from different cities within 24 hours.T1078

Panther #

Okta Sign-In from VPN Anonymizer source medium: A user is attempting to sign-in to Okta from a known VPN anonymizer. The threat actor would access the compromised account using anonymizing proxy services.T1556
Okta Login Signal source informational
Okta Login From CrowdStrike Unmanaged Device source medium linked query: Okta Login From CrowdStrike Unmanaged Device: Detects Okta Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.

Show 4 more (7 total) on the rules page

References #

Okta Event Types Catalog: user.session.start

user.mfa.promote_enrollment

Description

Promote authenticator enrollment during login to Okta. Track user facing promotion screen shown to promote authenticator enrollment and the corresponding user action taken. An outcome.result = SUCCESS indicates that the user enrolled in the authenticator and an outcome.result = SKIPPED indicates that the user skipped enrollment.

Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.

References #

Okta Event Types Catalog: user.mfa.promote_enrollment

user.realm.update

Description

User realm updated.

Example System Log Event #

{
  "published": 1782501746096,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000002",
  "actor": {
    "id": "00u00000000000000002",
    "type": "User",
    "alternateId": "user02@dw-harness.example",
    "displayName": "DW Harness 02",
    "detailEntry": {
      "realmId": "guo00000000000000003"
    }
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0",
      "os": "Windows 10",
      "browser": "FIREFOX"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.22",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "00u00000000000000004",
      "type": "User",
      "alternateId": "user03@dw-harness.example",
      "displayName": "DW Harness 03",
      "detailEntry": {
        "realmId": "guo00000000000000003"
      }
    },
    {
      "id": "guo00000000000000003",
      "type": "Realm",
      "alternateId": "user04@dw-harness.example",
      "displayName": "DW Harness 04",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.22",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "user.realm.update",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000002",
    "detail": {}
  },
  "debugContext": {
    "debugData": {
      "behaviors": "{New Geo-Location=BAD_REQUEST, New Device=BAD_REQUEST, New ASN=BAD_REQUEST, New IP=NEGATIVE, New State=BAD_REQUEST, New Country=BAD_REQUEST, Velocity=BAD_REQUEST, New City=BAD_REQUEST}",
      "requestId": "00000000000000000000000000000002",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
      "origin": "https://app.example.com App app.example.com",
      "risk": "{reasons=Anomalous Location, level=MEDIUM}",
      "requestUri": "00000000000000000000000000000000000000000000000000000000000002",
      "url": "00000000000000000000000000000000000000000000000000000000000002?"
    }
  },
  "displayMessage": "User Realm Updated",
  "gatewayContext": null,
  "legacyEventType": null,
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    },
    "risk": {
      "level": "MEDIUM",
      "reasons": [
        "Anomalous Location"
      ]
    },
    "userBehaviors": [
      {
        "name": "New ASN",
        "id": "bhv00000000000000005",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New IP",
        "id": "bhv00000000000000006",
        "result": "NEGATIVE"
      },
      {
        "name": "New State",
        "id": "bhv00000000000000007",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Country",
        "id": "bhv00000000000000008",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Geo-Location",
        "id": "bhv00000000000000009",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New Device",
        "id": "bhv00000000000000010",
        "result": "BAD_REQUEST"
      },
      {
        "name": "Velocity",
        "id": "bhv00000000000000011",
        "result": "BAD_REQUEST"
      },
      {
        "name": "New City",
        "id": "bhv00000000000000012",
        "result": "BAD_REQUEST"
      }
    ]
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "10200000000000000013",
    "externalSessionId": "10200000000000000013"
  }
}