name: Okta Account Lockout Events
id: 62b70968-a0a5-4724-8ac4-67871e6f544d
version: 2
date: '2020-07-21'
author: Rico Valdez, Splunk
type: batch
datamodel: []
description: Detect Okta user lockout events
search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country
  as country, client.geographicalContext.state as state, client.geographicalContext.city
  as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` '
how_to_implement: This search is specific to Okta and requires Okta logs are being
  ingested in your Splunk deployment.
known_false_positives: None. Account lockouts should be followed up on to determine
  if the actual user was the one who caused the lockout, or if it was an unauthorized
  actor.
references: []
tags:
  analytic_story:
  - Suspicious Okta Activity
  asset_type: Infrastructure
  cis20:
  - CIS 16
  mitre_attack_id:
  - T1078.001
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - displayMessage
  - client.geographicalContext.country
  - client.geographicalContext.state
  - client.geographicalContext.city
  security_domain: access
