Okta Suspicious Activity Reported

Status: production
Severity: medium
Group by: "client.geographicalContext.city", "client.geographicalContext.country", "client.userAgent.browser", "client.userAgent.rawUserAgent", dest, eventType, src, user
Author: Michael Haag, Splunk
Source: github.com/splunk/security_content

The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the user.account.report_suspicious_activity_by_enduser event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.

Known false positives

False positives should be minimal, given the high fidelity of this detection. marker.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.001` Valid Accounts: Default Accounts
Persistence	`T1078.001` Valid Accounts: Default Accounts
Privilege Escalation	`T1078.001` Valid Accounts: Default Accounts
Stealth	`T1078.001` Valid Accounts: Default Accounts

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.account.report_suspicious_activity_by_enduser`: User reported suspicious account activity

Rules detecting the same action

These rules filter on the same operation.

Okta Suspicious Activity Reported by End-user (Sigma)
Okta User Reported Suspicious Activity (Panther)
Okta User Suspicious Activity Reported (YARA-L)
Suspicious Activity Reported by Okta User (Elastic)

Rule body

name: Okta Suspicious Activity Reported
id: bfc840f5-c9c6-454c-aa13-b46fd0bf1e79
version: 12
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the `user.account.report_suspicious_activity_by_enduser` event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.
data_source:
    - Okta
search: |-
    `okta` eventType=user.account.report_suspicious_activity_by_enduser
      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
        BY user dest src
           eventType client.userAgent.rawUserAgent client.userAgent.browser
           client.geographicalContext.city client.geographicalContext.country
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_suspicious_activity_reported_filter`
how_to_implement: This detection utilizes logs from Okta Identity Management (IM) environments. It requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553). Additionally, it necessitates the activation of suspicious activity reporting and training for associates to report such activities.
known_false_positives: False positives should be minimal, given the high fidelity of this detection. marker.
references:
    - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
finding:
    title: A user [$user$] reported suspicious activity in Okta. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
asset_type: Okta Tenant
mitre_attack_id:
    - T1078.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

Stages and Predicates

Stage 1: `search`

`okta` eventType=user.account.report_suspicious_activity_by_enduser

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
    BY user dest src
       eventType client.userAgent.rawUserAgent client.userAgent.browser
       client.geographicalContext.city client.geographicalContext.country

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `okta_suspicious_activity_reported_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventType`	eq	`user.account.report_suspicious_activity_by_enduser`	`field:"eventType" kind:eq value:"user.account.report_suspicious_activity_by_enduser"`
`sourcetype`	eq	`OktaIM2:log`	`field:"sourcetype" kind:eq value:"OktaIM2:log"`