Okta: User reports suspicious activity on their own account via end-user activity report event

Flags Okta end-user self-submitted reports of potentially suspicious activity on their account.

FreeUnreviewedSigmahighv1

okta-user-reports-suspicious-activity-on-their-own-account-via-end-user-activity-07e97cc6

title: "Okta: User reports suspicious activity on their own account via end-user activity report event"
id: 70194f24-0ed9-4953-9944-92e55f34be1c
status: test
description: This rule matches Okta System Log events where an end-user submits an account report indicating potentially suspicious activity. Such reports can signal that a user observed anomalies that may be linked to account compromise or unauthorized access attempts. The detection relies on the Okta eventType value in System Log telemetry.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_suspicious_activity_enduser_report.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
  - attack.resource-development
  - attack.t1586.003
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: user.account.report_suspicious_activity_by_enduser
  condition: selection
falsepositives:
  - If an end-user incorrectly identifies normal activity as suspicious.
level: high
license: DRL-1.1
related:
  - id: 07e97cc6-aed1-43ae-9081-b3470d2367f1
    type: derived

What it detects

This rule matches Okta System Log events where an end-user submits an account report indicating potentially suspicious activity. Such reports can signal that a user observed anomalies that may be linked to account compromise or unauthorized access attempts. The detection relies on the Okta eventType value in System Log telemetry.

Known false positives

If an end-user incorrectly identifies normal activity as suspicious.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.