sequence by okta.actor.id with maxspan=10m
  [ any
    where event.dataset == "okta.system"
      and (
        okta.event_type == "user.mfa.okta_verify.deny_push"
        or (
          okta.event_type == "user.authentication.auth_via_mfa"
          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
          and okta.outcome.reason == "INVALID_CREDENTIALS"
        )
      )
  ] with runs=5
  [ any
    where event.dataset == "okta.system"
      and okta.event_type in (
        "user.authentication.sso",
        "user.authentication.auth_via_mfa",
        "user.authentication.verify",
        "user.session.start"
      )
      and okta.outcome.result == "SUCCESS"
  ]