detection.wiki

Okta coverage

190 Okta detection rules across 6 vendors covering 81 eventTypes.

Okta records administrative and authentication activity in the System Log. Every entry carries an eventType, a dotted string whose first segment is a namespace prefix (for example user.session.start, policy.rule.update, system.api_token.create). That string is the value every corpus filters on, so this page groups the combined Sigma, Elastic, Sentinel, and Chronicle rules by eventType, organized under the prefix categories. Each eventType maps to a catalog entry under the Okta catalog.

Some eventTypes are emitted only by Okta Identity Engine (OIE) orgs and never by Classic Engine orgs; those entries are flagged on their event pages.

Attributed to a specific event type

149 rules that name a specific Okta eventType, mapped to that eventType's catalog event.

Authentication 79 rules, 11 eventTypes

User Authentication Auth Via AD Agent 2 rules
User Authentication Auth Via IdP 2 rules
User Authentication Auth Via Inbound SAML 1 rule
User Authentication Auth Via MFA 19 rules
User Authentication Auth Via Social 1 rule
User Authentication SSO 11 rules
User Authentication Verify 5 rules
User Session Access Admin App 1 rule
User Session Impersonation Grant 3 rules
User Session Impersonation Initiate 4 rules
User Session Start 30 rules

MFA 29 rules, 7 eventTypes

User MFA Attempt Bypass 3 rules
User MFA Factor Activate 3 rules
User MFA Factor Deactivate 6 rules
User MFA Factor Reset All 7 rules
User MFA Factor Suspend 3 rules
User MFA Factor Update 3 rules
User MFA Okta Verify Deny Push 4 rules

Lifecycle 24 rules, 9 eventTypes

User Account Lock 4 rules
User Account Lock Limit 2 rules
User Account Privilege Grant 5 rules
User Account Report Suspicious Activity By Enduser 5 rules
User Account Reset Password 3 rules
User Account Unlock Token 1 rule
User Account Update Password 1 rule
User Lifecycle Activate 1 rule
User Lifecycle Create 2 rules

Policy 29 rules, 8 eventTypes

Policy Evaluate Sign On 8 rules
Policy Lifecycle Create 1 rule
Policy Lifecycle Deactivate 2 rules
Policy Lifecycle Delete 3 rules
Policy Lifecycle Update 5 rules
Policy Rule Deactivate 2 rules
Policy Rule Delete 3 rules
Policy Rule Update 5 rules

Admin 56 rules, 25 eventTypes

Application Lifecycle Activate 1 rule
Application Lifecycle Create 1 rule
Application Lifecycle Deactivate 1 rule
Application Lifecycle Delete 2 rules
Application Lifecycle Update 4 rules
Application User Membership Change Username 4 rules
Application User Membership Show Password 1 rule
Group Privilege Grant 6 rules
System Agent Ad Config Change Detected 2 rules
System API Token Create 9 rules
System API Token Revoke 4 rules
System Email Account Unlock Sent Message 1 rule
System Email Password Reset Sent Message 1 rule
System IdP Lifecycle Activate 1 rule
System IdP Lifecycle Create 3 rules
System IdP Lifecycle Deactivate 1 rule
System IdP Lifecycle Delete 1 rule
System MFA Factor Deactivate 2 rules
System Org Rate Limit Violation 1 rule
System Org Rate Limit Warning 1 rule
System Push Send Factor Verify Push 5 rules
System SMS Send Account Unlock Message 1 rule
System SMS Send Password Reset Message 1 rule
System Voice Send Account Unlock Call 1 rule
System Voice Send Password Reset Call 1 rule

Threat 11 rules, 3 eventTypes

Security Attack End 1 rule
Security Attack Start 2 rules
Security Threat Detected 8 rules

Other 26 rules, 17 eventTypes

App Generic Unauth App Access Attempt 3 rules
App OAuth2 As Token Detect Reuse 1 rule
App OAuth2 As Token Grant 1 rule
App OAuth2 Token Detect Reuse 1 rule
Application Integration Rate Limit Exceeded 1 rule
Application Policy Sign On Rule Delete 3 rules
Application Policy Sign On Update 3 rules
Core Concurrency Org Limit Violation 1 rule
Device Enrollment Create 1 rule
IAM Resourceset Bindings Add 1 rule
IAM Role Create 1 rule
IAM Role Permissions Add 1 rule
Network Zone Rule Disabled 2 rules
Zone Deactivate 2 rules
Zone Delete 2 rules
Zone Remove Blacklist 1 rule
Zone Update 1 rule

Not attributed to an Okta event type

41 rules that resolve to no single Okta eventType: they pivot on a wildcard eventType or on secondary fields (outcome.result, displayMessage).

(unattributed) 41 rules, 1 eventType

(any event) 41 rules