Okta User Account Lockout Triggered by Max Sign-In Attempts
Flags Okta user account lockouts triggered by exceeding the max sign-in attempts threshold.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
Detects Okta system log events where a user account lockout occurs due to exceeding the maximum allowed sign-in attempts. This behavior matters because attackers may intentionally provoke lockouts to disrupt access or to test authentication defenses. The rule relies on Okta telemetry using the specific system log message indicating “Max sign in attempts exceeded.”
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-account-locked-out-after-max-sign-in-attempts-14701da0
title: Okta User Account Lockout Triggered by Max Sign-In Attempts
id: d68762eb-73dc-480e-b28a-c84e8e9cfffa
status: test
description: Detects Okta system log events where a user account lockout occurs due to exceeding the maximum allowed sign-in attempts. This behavior matters because attackers may intentionally provoke lockouts to disrupt access or to test authentication defenses. The rule relies on Okta telemetry using the specific system log message indicating “Max sign in attempts exceeded.”
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_user_account_locked_out.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.impact
- attack.t1531
logsource:
product: okta
service: okta
detection:
selection:
displayMessage: Max sign in attempts exceeded
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a
type: derived