Sunturai
Back to results
InformationalSplunk security contentBhavin Patel +1

Okta User Logins from Multiple Cities

The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their…

Description

The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their geographic locations. Such behavior is significant as it may indicate a compromised account, with an attacker attempting unauthorized access from multiple locations. If confirmed malicious, this activity could lead to account takeovers and data breaches, allowing attackers to access sensitive information and potentially escalate their privileges within the environment.

Detection logic

Detection requirements

Platform
PRE

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
okta

Known benign triggers

  • It is uncommon for a user to log in from multiple cities simultaneously, which may indicate a false positive.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice