[OKTA] USER HAS REPORTED SUSPICIOUS ACTIVITY

alert any $EXTERNAL_NET any -> any $HOME_NET (msg: "[OKTA] USER HAS REPORTED SUSPICIOUS ACTIVITY"; content:"User report suspicious activity"; normalize; parse_proto; parse_port; parse_src_ip: 3; default_proto: tcp; json_map: "username", ".actor.alternateId"; classtype: network-event; threshold: type suppress, track by_src&by_username, count 3, seconds 3600; reference:url, help.okta.com/en/prod/Content/Topics/Security/suspicious-activity-reporting.htm; sid:5006602; rev:2;)