diff --git a/detections/okta_failed_sso_attempt.yml b/detections/okta_failed_sso_attempt.yml
new file mode 100644
index 0000000000..57df64ca52
--- /dev/null
+++ b/detections/okta_failed_sso_attempt.yml
@@ -0,0 +1,69 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: Detect failed Okta SSO events
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: Okta user $user$ attempted to access unauthorized app
+        rule_title: Okta user SSO attempt to unauthorized app
+      risk:
+        risk_object: user
+        risk_object_type:
+          - user
+        risk_score: 50
+      macros:
+        - okta_failed_sso_attempt_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log displayMessage="User attempted unauthorized access to app" | stats  min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`okta_failed_sso_attempt_filter`'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search looks for events that indicate a user attempted to access an app they did not have permissions to access. This could indicate attempts to access prohibited applications. Please leverage the `okta_failed_sso_attempt_filter` macro to filter out false positives
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 371a6545-2618-4032-ad84-93386b8698c5
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activities In Okta
+    type: splunk
+  - id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
+    name: Investigate Okta Activity by App
+    type: splunk
+known_false_positives: There may be a faulty config preventing legitmate users from accessing apps they should have access to. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta Failed SSO Attempts
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"
diff --git a/detections/okta_multiple_users_with_auth_failures_from_ip.yml b/detections/okta_multiple_users_with_auth_failures_from_ip.yml
new file mode 100644
index 0000000000..854e39ddaf
--- /dev/null
+++ b/detections/okta_multiple_users_with_auth_failures_from_ip.yml
@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address.
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: src_ip
+        rule_description: Multiple Users Failing Authenticaiton From $src_ip$
+        rule_title: Multiple Okta Users With Authentication Failures From a Single IP
+      risk:
+        risk_object: system
+        risk_object_type:
+          - system
+        risk_score: 50
+      macros:
+        - okta_multiple_users_with_auth_failures_from_ip_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |  search distinct_users > 5| `okta_multiple_users_with_auth_failures_from_ip_filter`'
+      suppress:
+        suppress_fields: src_ip
+        suppress_period: 86400s
+eli5: This search detects instances when there are more than 5 distinct users failing Okta logins due to invalid credentails from the same IP address. This may be indicative of attack techniques such as credential stuffing or password spraying, where an attacker attempts to login using common or found passwords and attempts to authenticate with them. 
+entities:
+  - src_ip
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 19cba45f-cad3-4032-8911-0c09e0444552
+investigations:
+  - id: 56aae066-d619-477c-93e3-3fb83b2d23c3
+    name: Investigate Okta Activity by IP Address
+    type: splunk
+known_false_positives: A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Multiple Okta Users With Invalid Credentails From The Same IP
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"
diff --git a/detections/okta_user_lockouts.yml b/detections/okta_user_lockouts.yml
new file mode 100644
index 0000000000..549729a2bf
--- /dev/null
+++ b/detections/okta_user_lockouts.yml
@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: Detect Okta user lockout events
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: User $user$ locked out of Okta - too many attempts
+        rule_title: Okta user lockout events
+      risk:
+        risk_object: user
+        risk_object_type:
+          - user
+        risk_score: 50
+      macros:
+        - okta_user_lockouts_filter
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -70m@m
+        latest_time: -10m@m
+      search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip |`okta_user_lockouts_filter`'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search detects when a user exceeds the maximum configured Okta login attempts and the account is subsequently locked out. This is often indicative of brtue force attempts against a user account. 
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 62b70968-a0a5-4724-8ac4-67871e6f544d
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activity In Okta
+    type: splunk
+known_false_positives: None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor. 
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta Account Lockout Events
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"
diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/okta_user_logins_from_multiple_cities.yml
new file mode 100644
index 0000000000..d2f6af2418
--- /dev/null
+++ b/detections/okta_user_logins_from_multiple_cities.yml
@@ -0,0 +1,66 @@
+asset_type: Infrastructure
+confidence: high
+creation_date: '2020-04-01'
+data_metadata:
+  data_eventtypes:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search detects logins from the same user from different states in a 24 hour period.
+detect:
+  splunk:
+    correlation_rule:
+      notable:
+        nes_fields: user
+        rule_description: User $user$ logged into Okta from different cities
+        rule_title: Okta user login from different cities
+      risk:
+        risk_object: user
+        risk_object_type:
+          - system
+        risk_score: 50
+      macros:
+        - okta_user_logins_from_multiple_cities_filter       
+      schedule:
+        cron_schedule: 0 * * * *
+        earliest_time: -24h@h
+        latest_time: -5m@m
+      search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`okta_user_logins_from_multiple_cities_filter`| search locations > 1'
+      suppress:
+        suppress_fields: user
+        suppress_period: 86400s
+eli5: This search detects users logging in from multiple states in the last 24 hours. This can be indicative of an attacker using compromised credentials to log in to Okta. The efficacy of this search is highly dependant on the mobility of the users using Okta. It is particularly useful in situations where users should explicitly *not* be travelling, such as during the COVID-19 pandemic. 
+entities:
+  - user
+how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.'
+id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
+investigations:
+  - id: 24ff145d-4d16-420a-b047-480f2a51c403
+    name: Investigate User Activity In Okta
+    type: splunk
+known_false_positives: Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+mappings:
+  cis20:
+    - CIS 16
+  mitre_attack:
+    - Valid Accounts
+  mitre_technique_id:
+    - T1078
+  nist:
+    - DE.CM
+modification_date: '2020-04-01'
+name: Okta User Logins From Multiple Cities
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+security_domain: access
+spec_version: 2
+type: splunk
+version: "1"
diff --git a/investigations/get_okta_activity_by_app.yml b/investigations/get_okta_activity_by_app.yml
new file mode 100644
index 0000000000..3cc1ea16e9
--- /dev/null
+++ b/investigations/get_okta_activity_by_app.yml
@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events associated with a specific app
+entities:
+  - app
+how_to_implement: You must be ingesting Okta logs
+id: 420eb1b8-2992-45d1-80cf-0b1b2759524d
+investigate:
+  splunk:
+    fields_required:
+      - app
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log app={app} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate Okta Activity by app
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'
diff --git a/investigations/get_okta_activity_by_ip.yml b/investigations/get_okta_activity_by_ip.yml
new file mode 100644
index 0000000000..d99a0baa32
--- /dev/null
+++ b/investigations/get_okta_activity_by_ip.yml
@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events from a specific IP address.
+entities:
+  - src_ip
+how_to_implement: You must be ingesting Okta logs
+id: 56aae066-d619-477c-93e3-3fb83b2d23c3
+investigate:
+  splunk:
+    fields_required:
+      - user
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate Okta Activity by IP Address
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'
diff --git a/investigations/get_okta_user_activity.yml b/investigations/get_okta_user_activity.yml
new file mode 100644
index 0000000000..05ec99314d
--- /dev/null
+++ b/investigations/get_okta_user_activity.yml
@@ -0,0 +1,34 @@
+creation_date: '2020-04-02'
+data_metadata:
+  eventtype:
+    - okta_log
+  data_source:
+    - Okta
+  providing_technologies:
+    - Okta
+description: This search returns all okta events by a specific user
+entities:
+  - user
+how_to_implement: You must be ingesting Okta logs
+id: 24ff145d-4d16-420a-b047-480f2a51c403
+investigate:
+  splunk:
+    fields_required:
+      - user
+    schedule:
+      earliest_time: "86400"
+      latest_time: "14400"
+    search: 'eventtype=okta_log user={user} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason'
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Investigate User Activities In Okta
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+spec_version: 2
+type: splunk
+version: '1.0'
diff --git a/macros/okta_failed_sso_attempt_filter.yml b/macros/okta_failed_sso_attempt_filter.yml
new file mode 100644
index 0000000000..1d62efcfe0
--- /dev/null
+++ b/macros/okta_failed_sso_attempt_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_failed_sso_attempt_filter
\ No newline at end of file
diff --git a/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml b/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml
new file mode 100644
index 0000000000..be4ef2b1d3
--- /dev/null
+++ b/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_multiple_users_with_auth_failures_from_ip_filter
\ No newline at end of file
diff --git a/macros/okta_user_lockouts_filter.yml b/macros/okta_user_lockouts_filter.yml
new file mode 100644
index 0000000000..27f4329ce0
--- /dev/null
+++ b/macros/okta_user_lockouts_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_user_lockouts_filter
\ No newline at end of file
diff --git a/macros/okta_user_logins_from_multiple_cities_filter.yml b/macros/okta_user_logins_from_multiple_cities_filter.yml
new file mode 100644
index 0000000000..81b8ca5841
--- /dev/null
+++ b/macros/okta_user_logins_from_multiple_cities_filter.yml
@@ -0,0 +1,3 @@
+definition: search *
+description: Update this macro to limit the output results to filter out false positives. 
+name: okta_user_logins_from_multiple_cities_filter
\ No newline at end of file
diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json
index 1d8d648a5c..b4d1eab4b1 100644
--- a/spec/v2/baselines.spec.json
+++ b/spec/v2/baselines.spec.json
@@ -273,7 +273,8 @@
               "Ziften",
               "Censys",
               "Passive Total",
-              "WHOIS"
+              "WHOIS",
+              "Okta"
             ]
           },
           "minItems": 0,
diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json
index 9227102dc4..19b180117a 100644
--- a/spec/v2/detections.spec.json
+++ b/spec/v2/detections.spec.json
@@ -646,7 +646,8 @@
               "Sysmon",
               "Tanium",
               "Ziften",
-              "OSquery"
+              "OSquery",
+              "Okta"
             ]
           },
           "minItems": 0,
@@ -714,6 +715,7 @@
       "items": {
         "enum": [
           "accessKeyId",
+          "app",
           "arn",
           "awsRegion",
           "bucketName",
diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json
index d94dfc3801..bf07e97947 100644
--- a/spec/v2/investigations.spec.json
+++ b/spec/v2/investigations.spec.json
@@ -206,7 +206,8 @@
               "SMTP",
               "Cuckoo",
               "VirusTotal",
-              "DeepSight"
+              "DeepSight",
+              "Okta"
             ]
           },
           "minItems": 0,
@@ -234,6 +235,7 @@
         "enum": [
           "accessKeyId",
           "arn",
+          "app",
           "awsRegion",
           "bucketName",
           "City",
diff --git a/stories/suspicious_okta_activities.yml b/stories/suspicious_okta_activities.yml
new file mode 100644
index 0000000000..fd5ba53fad
--- /dev/null
+++ b/stories/suspicious_okta_activities.yml
@@ -0,0 +1,55 @@
+category:
+  - Adversary Tactics
+channel: ESCU
+creation_date: '2020-04-02'
+description: Monitor your Okta environment for suspicious activities. Due to the Covid 
+  outbreak, many users are migrating over to leverage cloud services more and more. 
+  Okta is a popular tool to manage multiple users and the web-based applications they need 
+  to stay productive. The searches in this story will help monitor your Okta environment for 
+  suspicious activities and associated user behaviors.
+detections: 
+  - detection_id: 371a6545-2618-4032-ad84-93386b8698c5
+    name: Okta Failed SSO Attempts
+    type: splunk
+  - detection_id: 19cba45f-cad3-4032-8911-0c09e0444552
+    name: Multiple Okta Users With Invalid Credentails From The Same IP
+    type: splunk
+  - detection_id: 62b70968-a0a5-4724-8ac4-67871e6f544d
+    name: Okta Account Lockout Events
+    type: splunk
+  - detection_id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8
+    name: Okta User Logins From Multiple Cities
+    type: splunk
+id: 9cbd34af-8f39-4476-a423-bacd126c750b
+maintainers:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+modification_date: '2020-04-02'
+name: Suspicious Okta Activity
+narrative: Okta is the leading single sign on (SSO) provider, allowing users to authenticate once 
+  to Okta, and from there access a variety of web-based applications. These applications are 
+  assigned to users and allow administrators to centrally manage which users are allowed to 
+  access which applications. It also provides centralized logging to help understand how the 
+  applications are used and by whom. \
+ 
+  While SSO is a major convenience for users, it also provides attackers with an opportunity. 
+  If the attacker can gain access to Okta, they can access a variety of applications. 
+  As such monitoring the environment is important. \
+
+  With people moving quickly to adopt web-based applications and ways to manage them, many 
+  are still struggling to understand how best to monitor these environments. This analytic 
+  story provides searches to help monitor this environment, and identify events and activity 
+  that warrant further investigation such as credential stuffing or password spraying attacks, 
+  and users logging in from multiple locations when travel is disallowed. 
+original_authors:
+  - company: Splunk
+    email: rvaldez@splunk.com
+    name: Rico Valdez
+references:
+  - https://attack.mitre.org/wiki/Technique/T1078
+  - https://owasp.org/www-community/attacks/Credential_stuffing
+  - https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work
+spec_version: 2
+usecase: Security Monitoring
+version: '1.0'