✄𐘗
text code block:
✄𐘗event.dataset: "okta.system"
    and okta.authentication_context.issuer.id: (* and not "Okta")
    and (
        event.action: (
            "user.authentication.auth_via_IDP"
            or "user.authentication.auth_via_inbound_SAML"
            or "user.authentication.auth_via_social"
        )
        or (
            event.action: "user.authentication.auth_via_IDP"
            and okta.outcome.result: "FAILURE"
            and okta.outcome.reason: (
                "A SAML assert with the same ID has already been processed by Okta for a previous request"
                or "Unable to match transformed username"
                or "Unable to resolve IdP endpoint"
                or "Unable to validate SAML Response"
                or "Unable to validate incoming SAML Assertion"
            )
        )
    )