Investigator’s Guide to Okta Logs: System Log Fields for Incident Response

A field guide to investigating Okta breaches: which System Log events matter, what dthash and session fields reveal, and how to trace a compromise.