Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful downloads of exported Okta analytics reports. A higher-severity signal is raised when multiple distinct reports are exported within a short window.

Strategy

This rule monitors Okta events where @evt.name is analytics.reports.export.download and @evt.outcome is SUCCESS. Export activity is tracked per @usr.email, counting distinct @target.id values within the evaluation window.

Triage and response

• Review @target and @target.id to identify which report was exported and whether {{@usr.email}} has a legitimate reporting or audit role.
• Determine whether the export is a first-time or recurring action for this user by checking prior signals and recent Okta activity for the same report targets.
• Examine @network.client.ip and @network.client.geoip for {{@usr.email}} and verify the source matches an expected corporate network, VPN, or remote-work location.