FROM logs-okta*
| WHERE
    event.dataset == "okta.system"
    // ignore authentication events where session and device token hash change often
    AND NOT event.action IN (
        "policy.evaluate_sign_on",
        "user.session.start",
        "user.authentication.sso"
    )
    // ignore Okta system events and only allow registered users
    AND (
        okta.actor.alternate_id != "system@okta.com"
        AND okta.actor.alternate_id RLIKE "[^@\\s]+\\@[^@\\s]+"
    )
    AND okta.authentication_context.external_session_id != "unknown"
| STATS
    dt_hash_counts = COUNT_DISTINCT(okta.debug_context.debug_data.dt_hash) BY
        okta.actor.alternate_id,
        okta.authentication_context.external_session_id
| WHERE
    dt_hash_counts >= 2
| SORT
    dt_hash_counts DESC