Detection rules › Sigma
Okta Suspicious Activity Reported by End-user
Detects when an Okta end-user reports activity by their account as being potentially suspicious.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Resource Development | T1586.003 Compromise Accounts: Cloud Accounts |
Event coverage
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- Okta Suspicious Activity Reported (Splunk)
- Okta User Suspicious Activity Reported (YARA-L)
- Suspicious Activity Reported by Okta User (Elastic)
Rule body yaml
title: Okta Suspicious Activity Reported by End-user
id: 07e97cc6-aed1-43ae-9081-b3470d2367f1
status: test
description: Detects when an Okta end-user reports activity by their account as being potentially suspicious.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
author: kelnage
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.resource-development
- attack.t1586.003
logsource:
product: okta
service: okta
detection:
selection:
eventType: 'user.account.report_suspicious_activity_by_enduser'
condition: selection
falsepositives:
- If an end-user incorrectly identifies normal activity as suspicious.
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventType: 'user.account.report_suspicious_activity_by_enduser'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventType | eq |
|