Bursty failed Okta admin console logins (excl. lockouts/helpdesk)
Detects high-frequency failed sign-in attempts (10+ failures in 15 minutes) targeting the Okta Admin Console. The rule filters out common expected failure modes such as password expiration, account lockouts, and known helpdesk account activity to prioritize potential brute-force or credential-stuffing attacks against privileged administrative accounts.
Microsoft Sentinel (KQL)
