Okta: End-user Reported Suspicious Activity Account Event Detection
Flags Okta end-user self-submitted reports of potentially suspicious activity on their account.
- Product
- okta
- Service
- okta
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches the Okta event where an end-user submits a report that activity for their account is potentially suspicious. Such reports can indicate attempted account compromise or unauthorized access, especially when users flag unusual sign-in or activity. Telemetry relies on Okta system logs capturing the specific event type for end-user suspicious activity reporting.
Reporting behind it
- developer.okta.comhttps://developer.okta.com/docs/reference/api/system-log/
- github.comhttps://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_suspicious_activity_enduser_report.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Okta: End-user Reported Suspicious Activity Account Event Detection"
id: 70194f24-0ed9-4953-9944-92e55f34be1c
status: test
description: This rule matches the Okta event where an end-user submits a report that activity for their account is potentially suspicious. Such reports can indicate attempted account compromise or unauthorized access, especially when users flag unusual sign-in or activity. Telemetry relies on Okta system logs capturing the specific event type for end-user suspicious activity reporting.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_suspicious_activity_enduser_report.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.resource-development
- attack.t1586.003
logsource:
product: okta
service: okta
detection:
selection:
eventType: user.account.report_suspicious_activity_by_enduser
condition: selection
falsepositives:
- If an end-user incorrectly identifies normal activity as suspicious.
level: high
license: DRL-1.1
related:
- id: 07e97cc6-aed1-43ae-9081-b3470d2367f1
type: derived