Before
An analyst likely had to search recent Okta sign-in events, count failed attempts, and determine whether the threshold had been reached. The analyst then had to create or update the PagerDuty incident, notify the SOC in Slack, and manually coordinate the acknowledgement or closure across both tools.
How it works
- Receive an Okta connection alert and retrieve recent sign-in events from the previous 30 minutes.
- Check whether the failed-login count exceeds four; if it does, create a PagerDuty incident and notify the SOC in Slack.
- Apply the analyst's acknowledgement or closure response to the alert and post a confirmation in Slack.
Workflow details
- Detection: The workflow begins when an Okta connection alert is received and retrieves recent sign-in events from the organization system log, covering the last 30 minutes.
- Threshold check: It evaluates the retrieved activity to determine whether a user has exceeded the five-failed-attempt threshold, allowing ordinary activity to pass without creating an alert.
- Incident creation: When the threshold is reached, the workflow creates a PagerDuty incident using the available event information and sends the SOC a Slack notification with options to acknowledge or close the alert.
- Analyst action: The analyst can select an acknowledgement or closure response directly from the Slack interaction, avoiding a separate handoff between the notification channel and the incident system.
- Status confirmation: The workflow updates the PagerDuty alert according to the analyst's response and sends a confirmation message back to the Slack channel.
What changed
Failed-login threshold checks and alert creation now happen automatically after the Okta trigger. The SOC receives the incident in Slack with an acknowledgement or closure option, while the selected response updates the PagerDuty alert and generates a confirmation.
Work removed
Searching recent Okta events, counting failed sign-in attempts, checking the threshold, creating the PagerDuty incident, copying alert information into Slack, and manually updating the alert after the analyst's response.
Expected outcome
For each qualifying event, the workflow removes one recurring investigation-and-handoff sequence involving at least five manual actions and provides a consistent Slack-based alert response path.
