Account-Lockout

Multiple Okta accounts locked out within a 5-minute period, detected via aggregated user.account.lock events, may indicate a password spraying attack leading to potential account takeovers.

Detection of an Okta user account lockout, which may indicate brute-force attempts or other malicious activity targeting user accounts.