okta_activity_audit.yml

AnalysisType: scheduled_query
QueryName: Okta Investigate User Activity
Enabled: false
Description: >
  Audit user activity across your environment. Customize to filter on specfic users, time ranges, etc
AthenaQuery: >
  SELECT actor.displayName AS actor_name, actor.alternateId AS actor_email, eventType, COUNT(*) AS activity_count
  FROM panther_logs.okta_systemlog
  WHERE p_occurs_since('7 days')
  AND actor.type = 'User'
  -- Uncomment lines below to filter by user email and/or eventType
  -- and actor_email = '<EMAIL_GOES_HERE>'
  -- and eventType = '<EVENTTYPE_GOES_HERE>'
  GROUP BY actor.displayName, actor.alternateId, eventType
  ORDER BY  actor_name, activity_count DESC
SnowflakeQuery: >
  SELECT actor:displayName AS actor_name, actor:alternateId AS actor_email, eventType, COUNT(*) AS activity_count
  FROM panther_logs.public.okta_systemlog
  WHERE p_occurs_since('7 days')
  AND actor:type = 'User'
  -- Uncomment lines below to filter by user email and/or eventType
  -- and actor_email = 'email'
  -- and eventType = 'eventType'
  GROUP BY actor:displayName, actor:alternateId, eventType
  ORDER BY  actor_name, activity_count DESC
Schedule:
  RateMinutes: 43200
  TimeoutMinutes: 1