Before
Security staff likely reviewed sign-in events individually, determined whether the attempts were failed logins, and counted occurrences over a ten-minute period. When the threshold was reached, they had to look up the username, confirm it was valid, and manually notify the designated security channel.
How it works
- Receive and inspect sign-in events sent through the webhook, filtering for failed login attempts.
- Check whether more than five failed logins occurred within ten minutes, then validate the associated username when the threshold is reached.
- Post an alert to the designated Slack channel for the security team to review.
Workflow details
- Event intake: An Okta event hook sends user sign-in attempts to the workflow through a webhook, which verifies the incoming request and processes the received events.
- Automated filtering: Each event is evaluated to determine whether it represents a failed login. The workflow then checks whether the failed-login limit has been exceeded, using more than five failed attempts within a ten-minute period as the escalation threshold.
- User validation: When the threshold is reached, the workflow searches for the user profile by email address and checks whether the username corresponds to a valid current user.
- Security alerting: If the user is validated, the workflow posts an alert to the designated Slack channel so the relevant team can review the suspicious login activity.
- Operational result: Routine event screening, threshold checking, identity lookup, and notification handoffs occur automatically, while the security team retains responsibility for deciding how to respond to the alert.
What changed
Qualifying failed-login bursts are identified and escalated automatically as events arrive. The workflow performs the threshold and user-validity checks before delivering the result to Slack, leaving the security team to investigate and decide on the appropriate response.
Work removed
Reviewing sign-in events one by one, identifying failed logins, counting attempts against the ten-minute threshold, searching for the user profile by email, checking whether the username is valid, and manually posting an alert to the security channel.
Expected outcome
Each qualifying login burst can remove at least three recurring manual actions—threshold review, user lookup, and security notification—while ensuring validated alerts reach the designated channel.
