Before
Security staff likely had to review failed sign-in events individually and count repeated attempts over a defined time period. They then had to look up the associated user in Okta and manually notify the security team when the activity appeared significant.
How it works
- Receive sign-in events and filter them for failed login activity.
- Correlate matching failures over a ten-minute sliding window and check whether the threshold of more than five attempts is reached.
- Validate the user profile in Okta and send a notification to the #security-alerts Slack channel when the conditions are met.
Workflow details
- Event intake: An Okta event hook sends sign-in attempts to the workflow through an emailhook trigger, which immediately returns a successful webhook verification response.
- Event filtering: Incoming events are expanded and checked to identify failed login activity, while non-matching events are excluded from further processing.
- Windowed correlation: Matching failed-login events are grouped using a sliding correlation window. The workflow triggers when more than five failed logins occur within ten minutes, or starts a new window when the period expires.
- User validation: Once the threshold is reached, the workflow searches Okta for the associated user profile and verifies that the username is valid before creating an alert.
- Security notification: For a valid user and qualifying burst of failed attempts, the workflow posts a message to the #security-alerts Slack channel so the security team can review the activity.
What changed
Failed login events are now filtered, correlated, threshold-checked, and user-validated automatically before the alert is delivered to Slack, leaving the security team to investigate the notified activity rather than assemble the alert manually.
Work removed
Manually reviewing failed login events, counting attempts across a ten-minute window, checking whether the associated user is valid, and copying qualifying incidents into the security alert channel.
Expected outcome
For each qualifying incident, the workflow removes at least four recurring review and handoff actions while ensuring the security channel receives a threshold-based alert for valid users.
