Detection rules › Sigma
Okta Suspicious Activity Reported by End-user
Detects when an Okta end-user reports activity by their account as being potentially suspicious.
Known false positives
- If an end-user incorrectly identifies normal activity as suspicious.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Resource Development |
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
- Okta Suspicious Activity Reported (Splunk)
- Okta User Reported Suspicious Activity (Panther)
- Okta User Suspicious Activity Reported (YARA-L)
- Suspicious Activity Reported by Okta User (Elastic)
Rule body
title: Okta Suspicious Activity Reported by End-user
id: 07e97cc6-aed1-43ae-9081-b3470d2367f1
status: test
description: Detects when an Okta end-user reports activity by their account as being potentially suspicious.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
author: kelnage
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.resource-development
- attack.t1586.003
logsource:
product: okta
service: okta
detection:
selection:
eventType: 'user.account.report_suspicious_activity_by_enduser'
condition: selection
falsepositives:
- If an end-user incorrectly identifies normal activity as suspicious.
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventType: 'user.account.report_suspicious_activity_by_enduser'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventType | eq |
| field:"eventType" kind:eq value:"user.account.report_suspicious_activity_by_enduser" |