Hi, @kbazp (kbazp)​ 

Thank you for posting on our Community page!

Here is a helpful link on how to set system logs: https://help.okta.com/en-us/content/topics/security/threat-insight/configure-threatinsight-system-log.htm

ThreatInsight can limit or block authentication requests from suspicious IP addresses based on the threat level detected. For example, if a specific IP address is suspected of malicious activity but the threat level is considered low, authentication requests from the IP address aren't denied access but might be subjected to a rate limit. The rate limit helps ensure that requests from a suspicious IP address don't overload authentication services and affect legitimate traffic. With the option to limit access requests from suspicious IP addresses, ThreatInsight can reduce the risk of malicious activity without blocking access for legitimate users. However, if an IP address is suspected of malicious activity and the threat level detected is high, authentication requests from the IP address are blocked.

Earn Today: New Okta Community Badges Have Arrived

Community members help others by clicking Like or Select as Best on responses. Try it today.

_____________________________________________________________________________