Every 5 minutes

Alert your security channel on lockouts and admin grants

Account lockouts, MFA resets and new admin roles appear in chat within minutes.

Runs: Every 5 minutes
Apps: Okta
AI: Not needed
Access: admin read (token inherits admin)

Send this to your assistant

Create a ClickRuntime automation: every 5 minutes, check the Okta System Log and post to #security in Slack whenever a user is locked out, has MFA reset, or is given an admin role, with the user and who made the change.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A two-person IT team is responsible for the Okta tenant at a 150-person firm. Overnight, one executive's account racks up fifteen failed sign-ins and gets locked out, another user's MFA factors are reset by someone nobody recognizes, and a new super admin is added. All of it sits in the System Log, which nobody reads in real time, and the first sign of trouble is a support ticket the next day.

Every five minutes, the Okta System Log is read for everything since the previous check, filtered down to the event types you care about (user lockouts, MFA factor resets, administrator role assignments), and each match is posted to a Slack channel with the user, the event, the actor, the IP address and the time.

It is meant for small security and IT teams that have no SIEM, or want a lightweight alert beside one.

What you get out of it

Account takeover attempts get seen early
A burst of lockouts against one user is a classic sign of password guessing. Seeing it within minutes lets you reset credentials and block the source before the attacker succeeds.
MFA resets are never silent
Resetting someone's factors is a favorite step in social engineering. An alert naming the admin who did it lets you phone the user and confirm the request was genuine. That one phone call can stop an attacker who has already talked their way past a help desk.
Privilege changes are accountable
If a new super administrator appears, the person responsible must be able to explain it. Posting it publicly in Slack deters casual changes and exposes unauthorized ones. That visibility is a strong deterrent against casual or careless privilege changes.
Protection without buying a SIEM
Teams without a security analytics platform still get alerts for the handful of event types that matter most, at no extra tooling cost. That makes basic detection possible for teams of any size, without a long procurement cycle.
A timeline for incident response
Each alert includes actor, IP and timestamp. That makes it faster to piece together what happened if you have to investigate or write an incident report later. That context turns a vague hunch into a documented sequence of events.

How it works

What happens, step by step

Every 5 minutes, ClickRuntime checks the Okta system log for events since its last check.
It keeps account lockouts, MFA resets and new admin role grants.
Each one is posted to your Slack security channel with who it affected, who did it and when.

Before it runs live

Connect Okta

What you get

RunsEvery 5 minutes

Alert your security channel on lockouts and admin grantstoday, 9:00Succeeded

Slack · #securityjordan@northwind.example was given an admin role (by Robin Hale, 2026-10-19T09:42 UTC)

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Act only on the items that match your own rules, and skip the rest
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Okta steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

security_event_alerts.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched

ORG = "northwind"
TYPES = {"user.account.lock": "locked out", "user.mfa.factor.reset_all": "had MFA reset",
         "user.account.privilege.grant": "was given an admin role"}

def okta(path, **params):
    resp = http.get(f"https://{ORG}.okta.com/api/v1/{path}", params=params,
                    headers={"Authorization": f"SSWS {credentials.secret('OKTA_API_TOKEN')}", "Accept": "application/json"})
    resp.raise_for_status()
    return resp.json()

@on_trigger
def run(event):
    since = state.get("since") or (datetime.now(timezone.utc) - timedelta(minutes=5)).isoformat()
    events = okta("logs", since=since, sortOrder="ASCENDING", limit=1000,
                  filter=" or ".join(f'eventType eq "{t}"' for t in TYPES))
    report_fetched(len(events))
    if not events:
        return {"summary": "Nothing new"}
    for e in events:
        user = (e.get("target") or [{}])[0].get("alternateId", "unknown user")
        notify.slack(f"{user} {TYPES[e['eventType']]} (by {e['actor']['displayName']}, {e['published'][:16]} UTC)",
                     channel="#security")
    state.set("since", events[-1]["published"])
    return {"posted": len(events)}

FAQ

Common questions

Which Okta events can it alert on?

Any System Log event type can be used. Common choices are user.account.lock, user.mfa.factor.reset_all and group or user privilege grants such as user.account.privilege.grant. You choose the list when you set it up. You can pick event types by their exact name in Okta's catalog.

How delayed are the alerts?

The log is checked every five minutes, so an alert normally appears within five to six minutes of the event. Okta log events themselves can take a short moment to be written, which adds a little delay.

Can failed sign-ins be alerted on only past a threshold?

Yes. Rather than post every single failure, the run can count failures per user in the window and alert only when the count passes a number you choose, such as five in five minutes. This cuts noise considerably.

What permissions does it need?

admin read (token inherits admin). Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it checks. Checks that find nothing new and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily