Okta User Logins from Multiple Cities
Last updated 2 days ago on 2026-07-17
About
The following analytic identifies instances where the same Okta user logs in from different cities within a 24-hour period. This detection leverages Okta Identity Management logs, analyzing login events and their geographic locations. Such behavior is significant as it may indicate a compromised account, with an attacker attempting unauthorized access from multiple locations. If confirmed malicious, this activity could lead to account takeovers and data breaches, allowing attackers to access sensitive information and potentially escalate their privileges within the environment.
- Platform
Splunk
- Tags
- Data Source: SplunkDomain: ApplicationRule Type: QueryOS: Any
- Severity
- medium
- Risk Score
- 47
- References
- https://attack.mitre.org/techniques/T1110/003/(external, opens in a new tab or window)
- False Positives
- It is uncommon for a user to log in from multiple cities simultaneously, which may indicate a false positive.
- Source
- View on GitHub(external, opens in a new tab or window)
Definition
- Rule Language
- SPL
- Rule Type
- query
text code block:| tstats `security_content_summariesonly` values(Authentication.app) as app values(Authentication.action) as action values(Authentication.user) as user values(Authentication.reason) as reason values(Authentication.dest) as dest values(Authentication.signature) as signature values(Authentication.method) as method FROM datamodel=Authentication WHERE Authentication.signature=user.session.start BY _time Authentication.src | `drop_dm_object_name("Authentication")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | iplocation src | stats count min(_time) as firstTime max(_time) as lastTime dc(src) as distinct_src dc(City) as distinct_city values(src) as src values(City) as City values(Country) as Country values(action) as action BY user | where distinct_city > 1 | `okta_user_logins_from_multiple_cities_filter`
View this rule on Splunk
This rule was sourced from the official Splunk public repository. View the original rule on GitHub(external, opens in a new tab or window).