Detection rules › Splunk
Okta Suspicious Activity Reported
The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the user.account.report_suspicious_activity_by_enduser event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078.001 Valid Accounts: Default Accounts |
| Persistence | T1078.001 Valid Accounts: Default Accounts |
| Privilege Escalation | T1078.001 Valid Accounts: Default Accounts |
| Stealth | T1078.001 Valid Accounts: Default Accounts |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body splunk
name: Okta Suspicious Activity Reported
id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
version: 12
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the `user.account.report_suspicious_activity_by_enduser` event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.
data_source:
- Okta
search: |-
`okta` eventType=user.account.report_suspicious_activity_by_enduser
| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
BY user dest src
eventType client.userAgent.rawUserAgent client.userAgent.browser
client.geographicalContext.city client.geographicalContext.country
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `okta_suspicious_activity_reported_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). Additionally, it necessitates the activation of suspicious activity reporting and training for associates to report such activities.
known_false_positives: False positives should be minimal, given the high fidelity of this detection. marker.
references:
- https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
finding:
title: A user [$user$] reported suspicious activity in Okta. Investigate further to determine if this was authorized.
entity:
field: user
type: user
score: 50
analytic_story:
- Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
- T1078.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: application
security_domain: access
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user.log
source: Okta
sourcetype: OktaIM2:log
test_type: unit
Stages and Predicates
Stage 1: search
`okta` eventType=user.account.report_suspicious_activity_by_enduser
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
BY user dest src
eventType client.userAgent.rawUserAgent client.userAgent.browser
client.geographicalContext.city client.geographicalContext.country
Stage 3: search
| `security_content_ctime(firstTime)`
Stage 4: search
| `security_content_ctime(lastTime)`
Stage 5: search
| `okta_suspicious_activity_reported_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventType | eq |
|
sourcetype | eq |
|