Hey @k5hmx (k5hmx)​,

I'd take a look at doing something like this:

Here's how I set this up:

• Use a Scheduled Flow - set it to run at your desired frequency.
• Use a Date - Subtract card to generate the time that the flow last ran...
  • e.g., if the flow runs every 24 hours, subtract a day... if it runs every 4 hours, subtract 4 hours, etc.
  • this allows us to select the time window we're searching in, so that we don't continue to pick up the same events in subsequent searches
• Use an Okta - Search System Logs card with the "Event Type" and "Since" inputs selected.
  • use security.threat.detected for the event type, and drag the output from your Date - Subtract into the since input.

I've attached a sample flow for you to take a look at as well. You can import it into your Workflows environment.

Some notes:

• If 'security.threat.detected' were available as an Okta Event Hook, my preference would be to set the flow up to run off of that trigger rather than use a scheduling (polling) design that looks for events that already happened. A webhook would be more immediate. If that event becomes Event Hook eligible in the future, I would use that instead.
• In my example, I'm only looking for the first matching event in the Okta - Search System Logs card, meaning the card will return a maximum of one record. In the case that you may have multiple events you wish to handle, you'll need to use a List function to handle each event. Here's a video in case you need a refresher on that: https://www.youtube.com/watch?v=H-E_ONzYNwA&list=PLSAWywyhniCMgo-IPIR-tleTPgNYiJwZn&index=19

As always, feel free to join us in a Community Office Hours session where you can join the Okta team and other customers to discuss what you're working on, get help with roadblocks, or just listen in and see what's happening. You can book anytime here: https://calendly.com/oktaworkflows - and there is also a link from the homepage of Workflows: