okta:systemlog user.session.start
user.session.start
- Log source
- Okta System Log
- Host type
- Identity providers and SaaS (Okta, GitHub, Slack, ...)
- Tier, host type
- Minimum
- Techniques
- 1
- Rules depending on it
- Elastic 9, Microsoft Sentinel 5
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Identity providers and SaaS | Minimum |
Techniques it helps detect
Rules that depend on it
Elastic 9
- Multiple Device Token Hashes for Single Okta Session
- Multiple Okta User Authentication Events with Same Device Token Hash
- Okta Successful Login After Credential Attack
- Okta User Sessions Started from Different Geolocations
- Potential Okta Brute Force (Device Token Rotation)
- Potential Okta Brute Force (Multi-Source)
- Potential Okta Credential Stuffing (Single Source)
- Potential Okta Password Spray (Multi-Source)
- Potential Okta Password Spray (Single Source)