Okta Non-Standard VPN Usage Detection

This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.