huntrule

Possible OneLogin User Account Locked (via onelogin.events)

This rule detects when an user account is locked or suspended.

SigmalowIdentityv1
sigma
title: Possible OneLogin User Account Locked (via onelogin.events)
id: d5342ca0-aac0-54bd-aa0d-04b15f310bde
status: stable
description: This rule detects when an user account is locked or suspended.
references:
    - https://developers.onelogin.com/api-docs/1/events/event-resource/
author: Huntrule Team
date: 2026-07-19
tags:
    - attack.impact
    - attack.t1531
logsource:
    product: onelogin
    service: onelogin.events
detection:
    selection1:
        event_type_id: 532
    selection2:
        event_type_id: 553
    selection3:
        event_type_id: 551
    condition: 1 of selection*
falsepositives:
    - Unknown
level: low

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.