For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-4jz.md. A documentation index is available at /llms.txt.

Okta report export downloaded

okta

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

Goal

Detects successful downloads of exported Okta analytics reports. A higher-severity signal is raised when multiple distinct reports are exported within a short window.

Strategy

This rule monitors Okta events where @evt.name is analytics.reports.export.download and @evt.outcome is SUCCESS. Export activity is tracked per @usr.email, counting distinct @target.id values within the evaluation window.

Triage and response

  • Review @target and @target.id to identify which report was exported and whether {{@usr.email}} has a legitimate reporting or audit role.
  • Determine whether the export is a first-time or recurring action for this user by checking prior signals and recent Okta activity for the same report targets.
  • Examine @network.client.ip and @network.client.geoip for {{@usr.email}} and verify the source matches an expected corporate network, VPN, or remote-work location.