detection.wiki

Okta coverage

179 Okta detection rules across 6 vendors covering 79 eventTypes.

Okta records administrative and authentication activity in the System Log. Every entry carries an eventType, a dotted string whose first segment is a namespace prefix (for example user.session.start, policy.rule.update, system.api_token.create). That string is the value every corpus filters on, so this page groups the combined Sigma, Elastic, Sentinel, and Chronicle rules by eventType, organized under the prefix categories. Each eventType maps to a catalog entry under the Okta catalog.

Some eventTypes are emitted only by Okta Identity Engine (OIE) orgs and never by Classic Engine orgs; those entries are flagged on their event pages. Rules that pivot only on a wildcard eventType or on secondary fields (outcome.result, displayMessage) cannot resolve to a single eventType and are grouped under (unattributed).

authentication 66 rules, 10 eventTypes

user.authentication.auth_via_IDP 2 rules
user.authentication.auth_via_inbound_SAML 1 rule
user.authentication.auth_via_mfa 18 rules
user.authentication.auth_via_social 1 rule
user.authentication.sso 8 rules
user.authentication.verify 4 rules
user.session.access_admin_app 1 rule
user.session.impersonation.grant 3 rules
user.session.impersonation.initiate 4 rules
user.session.start 24 rules

mfa 24 rules, 7 eventTypes

user.mfa.attempt_bypass 3 rules
user.mfa.factor.activate 1 rule
user.mfa.factor.deactivate 5 rules
user.mfa.factor.reset_all 6 rules
user.mfa.factor.suspend 2 rules
user.mfa.factor.update 3 rules
user.mfa.okta_verify.deny_push 4 rules

lifecycle 20 rules, 9 eventTypes

user.account.lock 2 rules
user.account.lock.limit 1 rule
user.account.privilege.grant 5 rules
user.account.report_suspicious_activity_by_enduser 4 rules
user.account.reset_password 3 rules
user.account.unlock_token 1 rule
user.account.update_password 1 rule
user.lifecycle.activate 1 rule
user.lifecycle.create 2 rules

policy 27 rules, 11 eventTypes

policy.evaluate_sign_on 7 rules
policy.lifecycle.create 1 rule
policy.lifecycle.deactivate 2 rules
policy.lifecycle.delete 3 rules
policy.lifecycle.modify 1 rule
policy.lifecycle.update 3 rules
policy.rule.create 1 rule
policy.rule.deactivate 2 rules
policy.rule.delete 3 rules
policy.rule.modify 1 rule
policy.rule.update 3 rules

admin 46 rules, 23 eventTypes

application.lifecycle.activate 1 rule
application.lifecycle.create 1 rule
application.lifecycle.deactivate 1 rule
application.lifecycle.delete 2 rules
application.lifecycle.update 4 rules
application.user_membership.show_password 1 rule
group.privilege.grant 5 rules
system.api_token.create 6 rules
system.api_token.revoke 4 rules
system.email.account_unlock.sent_message 1 rule
system.email.password_reset.sent_message 1 rule
system.idp.lifecycle.activate 1 rule
system.idp.lifecycle.create 3 rules
system.idp.lifecycle.deactivate 1 rule
system.idp.lifecycle.delete 1 rule
system.mfa.factor.deactivate 2 rules
system.org.rate_limit.violation 1 rule
system.org.rate_limit.warning 1 rule
system.push.send_factor_verify_push 5 rules
system.sms.send_account_unlock_message 1 rule
system.sms.send_password_reset_message 1 rule
system.voice.send_account_unlock_call 1 rule
system.voice.send_password_reset_call 1 rule

threat 10 rules, 3 eventTypes

security.attack.end 1 rule
security.attack.start 2 rules
security.threat.detected 7 rules

other 22 rules, 15 eventTypes

app.generic.unauth_app_access_attempt 1 rule
app.oauth2.as.token.grant 1 rule
application.integration.rate_limit_exceeded 1 rule
application.policy.sign_on.rule.delete 3 rules
application.policy.sign_on.update 3 rules
core.concurrency.org.limit.violation 1 rule
Events 1 rule
iam.resourceset.bindings.add 1 rule
iam.role.create 1 rule
iam.role.permissions.add 1 rule
network_zone.rule.disabled 2 rules
zone.deactivate 2 rules
zone.delete 2 rules
zone.remove_blacklist 1 rule
zone.update 1 rule

(unattributed) 60 rules, 1 eventType

(any event) 60 rules