investigate_okta_activity_by_ip_address.yml

name: Investigate Okta Activity by IP Address
id: 56aae066-d619-477c-93e3-3fb83b2d23c3
version: 1
date: '2020-04-02'
author: Rico Valdez, Splunk
type: Investigation
datamodel: []
description: This search returns all okta events from a specific IP address.
search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country,
  client.geographicalContext.state as state, client.geographicalContext.city as city
  | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
how_to_implement: You must be ingesting Okta logs
known_false_positives: ''
references: []
tags:
  analytic_story:
  - Suspicious Okta Activity
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - app
  - client.geographicalContext.country
  - client.geographicalContext.state
  - client.geographicalContext.city
  - user
  - displayMessage
  - src_ip
  - result
  - outcome.reason
  security_domain: network