name: Okta User Logins From Multiple Cities
id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
version: 2
date: '2020-07-21'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: This search detects logins from the same user from different cities in
  a 24 hour period.
search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
  | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)
  as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state)
  as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `okta_user_logins_from_multiple_cities_filter` | search locations > 1'
how_to_implement: This search is specific to Okta and requires Okta logs are being
  ingested in your Splunk deployment.
known_false_positives: Users in your enviornment may legitmately be travelling and
  loggin in from different locations. This search is useful for those users that should
  *not* be travelling for some reason, such as the COVID-19 pandemic. The search also
  relies on the geographical information being populated in the Okta logs. It is also
  possible that a connection from another region may be attributed to a login from
  a remote VPN endpoint.
references: []
tags:
  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
  - CIS 16
  mitre_attack_id:
  - T1078.001
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - displayMessage
  - client.geographicalContext.city
  - client.geographicalContext.state
  - user
  security_domain: access
