System Log events for Okta ThreatInsight
If Okta ThreatInsight actions are enabled, requests from malicious IP addresses are recorded as events in the admin System Log. Okta ThreatInsight evaluates sign-in activity before the user itself can be identified so security.threat.detected
events do not include a username.
- If
outcome.result
is DENY, the request was terminated. The username cannot be identified. However, you can view more information about why the request was terminated in the System Log event. For example: - If
outcome.result
is RATE_LIMIT, suspicious activity was detected. To prevent a malicious actor from consuming the rate limit for your org, the request was terminated and the username cannot be identified. However, you can view more information about why the request was terminated in the System Log event. For example: - If
outcome.result
is ALLOW, use the following query to search for other events with the sametransaction.id eq "<TRANSACTION_ID>"
. If there are other events in the transaction, the user can also be found in the actor field.
You can also audit sign-in requests to identify malicious activity by referring to the System Log and choosing to block IP addresses identified as malicious.
The security.threat.detected
event only appears if the request is deemed a high threat.
View System Log events
- In the Admin Console, navigate to Security > General
- Under Okta ThreatInsight Settings, click the System Log link.
Because you have navigated to the System Log from Okta ThreatInsight Settings, the search field is pre-populated with the query
eventType eq "security.threat.detected"
. - Configure the date range.
Org Under Attack
When an org is under attack, ThreatInsight flags IPs more aggressively, which can result in more security.threat.detected
events. You can view why an IP was identified as suspicious by reviewing the Reason field and the threat level that appears in the field Event.System.DebugContext.DebugData.ThreatDetections
.
For Org Under Attack events, you can search using the query eventType eq “security.attack.start”
and eventType eq “security.attack.end”
.