Okta account lockouts
Several Okta accounts locked out in a short window (user.account.lock).
What it detects
Several Okta accounts locked out in a short window (user.account.lock).
A single lockout is a forgotten password. Several across DIFFERENT accounts at once is a password-guessing run hitting the lockout threshold — and it is often the only trace left, because the individual failures may be spread thinly enough per account to stay under any per-user rule. The lockouts are the aggregate the attacker cannot avoid producing.
MITRE ATT&CK mapping
- T1110Brute Force· Credential Access
False positives and triage
A misconfigured application or a service account with a stale password will lock itself repeatedly and produce this from one source — check whether the accounts are distinct or the same one retrying. Grouping is by source IP, so a shared corporate NAT can gather unrelated user error into one group; a Monday-morning cluster after a password-policy change is expected. The signal is many DISTINCT accounts from one IP, especially accounts with no other relationship to each other.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/okta_account_lockouts.yaml, licensed under the Apache License 2.0.
id: cloud.okta.account_lockouts
version: 1.0.0
status: stable
severity: medium
confidence: 0.65
platforms: [application]
mitre_techniques: [T1110]
description: |
Several Okta accounts locked out in a short window (`user.account.lock`).
A single lockout is a forgotten password. Several across DIFFERENT accounts at once
is a password-guessing run hitting the lockout threshold — and it is often the only
trace left, because the individual failures may be spread thinly enough per account
to stay under any per-user rule. The lockouts are the aggregate the attacker cannot
avoid producing.
match:
provider: Okta
event_action_contains_any:
- user.account.lock
threshold:
count: 3
window_seconds: 600
group_by: [source_ip]
correlation_keys: [source_ip]
false_positive_guidance: |
A misconfigured application or a service account with a stale password will lock
itself repeatedly and produce this from one source — check whether the accounts are
distinct or the same one retrying. Grouping is by source IP, so a shared corporate
NAT can gather unrelated user error into one group; a Monday-morning cluster after a
password-policy change is expected. The signal is many DISTINCT accounts from one
IP, especially accounts with no other relationship to each other.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.