I'm attempting to build a search around Okta authentication logs. I want to run a query to check for any Multi factor update/change, collect the user ID and pass that to another search where I see the geolocation data where the User has authenticated previously over a specific time span. Essentially, I'm trying to build a search to see if a user that requested an MFA change is doing it from a different geolocation than they normally authenticate from.
The query below shows all users that have have a MFA change with their corresponding geolocation data. Is there a way to pass the user ID(s) to a different search where I can look at 7 days worth of their authentication activity to see if the geolocation matches?
I've researched sub-searches but that doesn't work because I need the user ID first but the subsearch runs first and I don't have the user ID yet. I looked at map which seems like it's the best solution, but there a lot of warnings about it being resource intensive. If anyone can point me in the right direction, it would be very much appreciated.
index=okta eventType="user.mfa.factor.update" | stats values(actor.id), values(client.geographicalContext.State)
