Okta Network Zone

eventType	Description	Sample	Rule
network_zone.rule.disabled		N	Y

network_zone.rule.disabled

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`okta::eventType` (kusto rule field)	eq	`user.session.start`	1 rule	kusto
`okta::eventType` (kusto rule field)	in	`user.mfa.factor.deactivate`	1 rule	kusto
`okta::eventType` (kusto rule field)	in	`user.mfa.factor.reset_all`	1 rule	kusto

Attempt to Modify an Okta Network Zone source medium: Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1484, T1562, T1562.007

New Device/Location sign-in along with critical operation source medium: This query identifies users seen login from a new geo location/country and a new device, then correlates that sign-in with successful risky operations such as policy changes, MFA changes, API token actions etc. This can be an indication of an attacker gaining access to a user's credentials and then performing critical operations, which typically requires admin privileges. By detecting such patterns, organizations can quickly respond to potential security incidents and mitigate risks associated with unauthorized access and privilege escalation.T1078, T1098, T1556