OneLogin User Account Locked or Suspended

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•0•21

This rule detects when a user account in OneLogin is locked or suspended, either through the API or other system actions. This could indicate an attempt to disrupt user access or a response to suspicious activity.