xwqww (xwqww) asked a question.
Hi Team,
I’ve been investigating service account creation events over the past 90 days, specifically those ingested into our SIEM platform. My query is based on the event type user.lifecycle.create, which should capture relevant account creation activities.
During this analysis, I noticed that system@okta.com appears to be responsible for creating several service accounts. While this seems unexpected, I want to confirm with the team before drawing any conclusions.
Currently, we don’t enforce a consistent naming convention for service accounts, which I understand is a known issue and something we’re working to improve. In the meantime, I’d like to explore whether there’s a reliable method to identify all service accounts created within a given timeframe (e.g., last X days), regardless of naming convention.
If anyone has insights or suggestions—especially around filtering or tagging these accounts more effectively in our SIEM—please share your thoughts.
Thanks.
Hello @xwqww (xwqww) , thank you for contacting Okta Community.
Unfortunately, if there is no specific naming convention for service accounts, and they do not have any groups or attributes specific to service accounts, there is no way to search for those accounts alone. There is nothing to differentiate those service accounts from a standard user account. You may have to manually review the created accounts to validate service vs user accounts.
If you have a paid account, you can try to open a Support ticket (Customer Support Account ID number required) so one of our engineers can analyze it and provide in-depth troubleshooting. You could also provide more details in a ticket that shouldn’t be given here, as this is a public space.
Please note that opening a support ticket is a feature available only to paid accounts. If you do not have a paid account, but are interested in upgrading, you can contact our Sales team.
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
This month's AMA topic: Okta Device Access. Ask away today.