This playbook provides systematic remediation steps to investigate incidents for user login failures on Okta.

The Okta User Login Failures from Multiple IPs playbook provides instructions on analyzing the alert when ServiceNow account failures are observed on Okta from Multiple Non-ServiceNow IPs. The alert related to this playbook checks the Okta logs. It triggers an alert when login failure occurs for ServiceNow user IDs from more than three non-ServiceNow IP ranges in a 1-hour duration.