Okta User Account Locked Out

Title: Okta User Account Locked Out
Status: test
Description:Detects when an user account is locked out.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://developer.okta.com/docs/reference/api/event-types/
Author: Austin Songer @austinsonger
Date: 2021-09-12
modified:2026-04-27
Tags:

• -'attack.impact'
• -'attack.t1531'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    displayMessage: 'Max sign in attempts exceeded'
  condition:selection
Falsepositives:
  -Unknown
Level: medium