Okta Account Locked Out After Max Sign-In Attempts

title: Okta Account Locked Out After Max Sign-In Attempts
id: d68762eb-73dc-480e-b28a-c84e8e9cfffa
status: test
description: This rule identifies Okta events where a user account is locked out after exceeding the maximum allowed sign-in attempts, based on the event message "Max sign in attempts exceeded." Account lockouts can indicate credential guessing or brute-force activity and can also be triggered by repeated legitimate failures. It relies on Okta system log event telemetry containing the display message for the lockout condition.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_user_account_locked_out.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: okta
  service: okta
detection:
  selection:
    displayMessage: Max sign in attempts exceeded
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a
    type: derived