Okta user reported suspicious activity

Documentos > Datadog Security > OOTB Rules > Okta user reported suspicious activity

Classification:

attack

Set up the okta integration.

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when an Okta user reports suspicious activity in response to an end user security notification.

Strategy

This rule monitors the case when an Okta user reports suspicious activity in response to an end user security notification. Suspicious Activity Reporting provides a user with the option to report unrecognized activity from email notifications about account activity. Account activity includes:

New sign-on notification
Authenticator enrolled
Authenticator reset
Password changed

Triage and response

Identify the event type (@debugContext.debugData.suspiciousActivityEventType) that occurred and the IP address (@debugContext.debugData.suspiciousActivityEventIp) from which suspicious activity originated.
Determine if any other activity has originated from this address by using the Cloud SIEM - IP Investigation dashboard.
If the activity appears to be harmful:
- Begin your organization’s incident response process and investigate for any account takeovers.