Suspicious Okta Login with MFA Failure from New Location
This rule detects suspicious Okta login attempts where a user successfully passes the initial authentication factor but then fails or abandons a subsequent Multi-Factor Authentication (MFA) challenge, originating from a new IP address, device (user agent), and city combination. It filters out events from known corporate VPN IP addresses to reduce false positives.
Splunk (SPL)
