author: Rico Valdez, Splunk
date: '2020-04-02'
description: This search returns all okta events from a specific IP address.
how_to_implement: You must be ingesting Okta logs
id: 56aae066-d619-477c-93e3-3fb83b2d23c3
inputs:
- user
name: Investigate Okta Activity by IP Address
search: eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
  as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason
tags:
  analytic_story:
  - Suspicious Okta Activity
  product:
  - Splunk Phantom
type: response
version: 1
