Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy

data_stream.dataset:okta.system
    and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:*
    and okta.event_type:user.authentication* and okta.security_context.is_proxy:true

False Positives

• ⚠ An Okta admnistrator may be logged into multiple accounts from the same host for legitimate reasons.
• ⚠ Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
• ⚠ Shared systems such as Kiosks and conference room computers may be used by multiple users.