# Source: https://docs.datadoghq.com/security/default_rules/def-000-z23.md

---
title: Okta OAuth mismatched URI
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Okta OAuth mismatched URI
---

# Okta OAuth mismatched URI
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1528-steal-application-access-token](https://attack.mitre.org/techniques/T1528) 
## Goal{% #goal %}

Detects an unexpected redirect when granting OAuth tokens.

## Strategy{% #strategy %}

This rule monitors failed OAuth access token grant activity where the provided reason is `mismatched_redirect_uri`. Alert severity is increased if Okta's provided threat suspected field evaluates to true. An adversary leveraging phishing infrastructure to compromise users may issue redirects to the phishing domain during the OAuth flow.

This detection has been adopted from rules published by the [Okta team](https://github.com/okta/customer-detections/).

## Triage & Response{% #triage--response %}

1. Examine the fields within `@debugContext.debugData` to compare the requested redirect URI to the allowed URIs and confirm the mismatch for `{{@usr.name}}`.
1. Review the source IP `{{@network.client.ip}}` and geoâlocation for anomalies or patterns shared across other failed OAuth attempts.
1. Analyze subsequent events to see if a successful token grant occurred shortly after, indicating bypass attempts or configuration correction.
1. If user activity is suspicious, begin your organization's incident response process and investigate for any account takeovers.