Detect Okta failed-login bursts and triage in Slack
Build a workflow that ingests Okta system log sign-in events (via polling or event hook). Count failed attempts per user within a window; when a user reaches five, open a PagerDuty incident with context and post to Slack with action buttons. Allow a responder to resolve the PagerDuty alert from Slack. Deduplicate per user/window, handle log pagination, and verify Slack interactivity signatures. Output the alert raised and its resolution state.
What this prompt builds
Watch Okta for repeated failed sign-ins, page on threshold, and let responders resolve from Slack.
The problem
Repeated failed Okta logins can signal a brute-force or credential-stuffing attempt, but the signal is buried in logs no one watches in real time. By the time it's noticed, an account may be locked or compromised.
Solution and impact
This workflow ingests Okta sign-in events, raises a PagerDuty alert when a user hits five failures, and lets responders resolve the alert directly from Slack. Suspicious login bursts get human eyes within minutes and a clean response loop.