After too many incorrect login attempts, a single user is receiving the following error when navigating to the login page:
403 Access Forbidden
Searching the System Log for:
eventType eq "security.threat.detected"
shows Request from suspicious actor Deny with that same user's IP address.
- ThreatInsight
- System Log
The user's IP address will be unblocked automatically after 24 hours. If is desired to immediately unblock the user's IP address, review the following knowledge article: How to Unblock an IP Address that is Blocked by ThreatInsight.
NOTE: IPs in the included Network Zones will not be logged or have actions enforced based on threat level by Okta ThreatInsight. These IPs will proceed to evaluation by sign-on rules. This ensures traffic from known, trusted IPs is not flagged by Okta ThreatInsight.
