Okta Suspicious Activity Reported by End-user

Title: Okta Suspicious Activity Reported by End-user
Status: test
Description:Detects when an Okta end-user reports activity by their account as being potentially suspicious.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
Author: kelnage
Date: 2023-09-07
modified:2026-04-27
Tags:

• -'attack.resource-development'
• -'attack.t1586.003'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    eventType: 'user.account.report_suspicious_activity_by_enduser'
  condition:selection
Falsepositives:
  -If an end-user incorrectly identifies normal activity as suspicious.
Level: high