Blog
Okta incident response guides: System Log export and analysis, MFA fatigue, helpdesk social engineering, session hijacking, rogue IdPs and admin abuse.
Why Okta identity detections misfire on corporate VPNs, mobile networks and helpdesk work, what the analyzer cannot see, and how to verify each finding.
A fictional Okta intrusion read event by event: helpdesk reset, attacker factor, Super Admin grant, rogue IdP and AWS access, with the analyzer's findings.
Detect password spraying, brute force and credential stuffing against Okta: failure patterns per IP and user, ThreatInsight events, and the success to hunt.
Find Okta admin role grants, API tokens, weakened policies and support impersonation in the System Log, and remove the persistence an attacker left behind.
How attackers add an inbound identity provider to an Okta org to sign in as any user, the System Log events that expose it, and how to remove the backdoor.
Detect Okta session hijacking in the System Log: one externalSessionId used from several ASNs or browsers, roaming events, and ruling out VPN and mobile noise.
How helpdesk social engineering turns into an Okta MFA reset and account takeover, the reset-then-enroll sequence in the logs, and how to tell it from support.
Detect MFA fatigue (push bombing) in the Okta System Log: the Classic and Identity Engine eventTypes, a workable threshold, false positives, and what to fix.
The Okta System Log eventTypes that matter in an incident, grouped by attack stage, with the fields to read and the Classic vs Identity Engine differences.