[OKTA] REQUEST FROM SUSPICIOUS ACTOR

alert any $EXTERNAL_NET any -> any $HOME_NET (msg: "[OKTA] REQUEST 
FROM SUSPICIOUS ACTOR"; content:"Request from suspicious actor"; normalize; parse_proto; parse_port; parse_src_ip: 1; parse_dst_ip: 2; default_proto: tcp; classtype: network-event; threshold: type suppress, track by_src, count 1, seconds 14400; reference:url, okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight.htm; sid:5006608; rev:1;)