Okta Zone

eventType	Description	Sample	Rule
zone.activate	Network zone activate.	Y	N
zone.create	Network zone create.	Y	N
zone.deactivate	Network zone deactivate.	Y	Y
zone.delete	Network zone delete.	Y	Y
zone.make_blacklist	Network zone mark as blacklist.	Y	N
zone.remove_blacklist	Network zone unmark as blacklist.	N	Y
zone.update	Network zone update.	Y	Y

zone.activate

Description

Network zone activate.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000133",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Network zone activate",
  "eventType": "zone.activate",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:59.858Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "IP",
        "gateways": [
          {
            "type": "CIDR",
            "value": "203.0.113.10/24"
          }
        ],
        "proxies": []
      },
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/zones/nzo00000000000000015/lifecycle/activate",
      "url": "/api/v1/zones/nzo00000000000000015/lifecycle/activate?"
    }
  },
  "legacyEventType": "zone.activate",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "NetworkZoneEntity",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: zone.activate

zone.create

Description

Network zone create.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000134",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Network zone create",
  "eventType": "zone.create",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:59.717Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "IP",
        "gateways": [
          {
            "type": "CIDR",
            "value": "203.0.113.10/24"
          }
        ],
        "proxies": []
      },
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/zones",
      "url": "/api/v1/zones?"
    }
  },
  "legacyEventType": "zone.create",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "NetworkZoneEntity",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

References #

Okta Event Types Catalog: zone.create

zone.deactivate

Description

Network zone deactivate.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000135",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Network zone deactivate",
  "eventType": "zone.deactivate",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:55:00.042Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "IP",
        "gateways": [
          {
            "type": "CIDR",
            "value": "203.0.113.10/24"
          }
        ],
        "proxies": []
      },
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/zones/nzo00000000000000015/lifecycle/deactivate",
      "url": "/api/v1/zones/nzo00000000000000015/lifecycle/deactivate?"
    }
  },
  "legacyEventType": "zone.deactivate",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "NetworkZoneEntity",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta Network Zone Deactivated or Deleted source medium: Detects when an Network Zone is Deactivated or Deleted.↳ also matches zone.delete

Elastic #

Attempt to Deactivate an Okta Network Zone source medium: Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1484, T1484.002, T1562, T1562.007

References #

Okta Event Types Catalog: zone.deactivate

zone.delete

Description

Network zone delete.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000136",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Network zone delete",
  "eventType": "zone.delete",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:55:00.150Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "IP",
        "gateways": [
          {
            "type": "CIDR",
            "value": "203.0.113.10/24"
          }
        ],
        "proxies": []
      },
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/zones/nzo00000000000000015",
      "url": "/api/v1/zones/nzo00000000000000015?"
    }
  },
  "legacyEventType": "zone.delete",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "NetworkZoneEntity",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Okta Network Zone Deactivated or Deleted source medium: Detects when an Network Zone is Deactivated or Deleted.↳ also matches zone.deactivate

Elastic #

Attempt to Delete an Okta Network Zone source medium: Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1562, T1562.007

References #

Okta Event Types Catalog: zone.delete

zone.make_blacklist

Description

Network zone mark as blacklist.

Example System Log Event #

{
  "published": 1784126963231,
  "id": null,
  "etag": null,
  "kind": null,
  "uuid": "00000000-0000-0000-0000-000000000143",
  "actor": {
    "id": "0oa00000000000000029",
    "type": "PublicClientAppEntity",
    "alternateId": "user06@dw-harness.example",
    "displayName": "DW Harness 17",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "okta-sdk-golang/6.1.6 golang/go1.26.2 linux/arm64 okta-terraform/6.13.0",
      "os": "Linux",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Computer",
    "id": null,
    "ipAddress": "192.0.2.43",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "events": null,
  "target": [
    {
      "id": "nzo00000000000000348",
      "type": "NetworkZoneEntity",
      "alternateId": "user06@dw-harness.example",
      "displayName": "DW Harness 119",
      "detailEntry": null
    }
  ],
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "request": {
    "ipChain": [
      {
        "ip": "192.0.2.43",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "version": "0",
  "severity": "INFO",
  "eventType": "zone.make_blacklist",
  "ipAddress": null,
  "networkInfo": null,
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000000000000074",
    "detail": {
      "rootApiTokenId": "0000000000000000000000000000000000000000000024",
      "requestApiTokenId": "0000000000000000000000000000000000000000000024",
      "requestApiTokenClientId": "0oa00000000000000029"
    }
  },
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "DYNAMIC_V2",
        "locations": {
          "include": [
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            },
            {
              "country": "Placeholderland",
              "region": null
            }
          ],
          "exclude": []
        },
        "ipServiceCategories": {
          "include": [
            "ALL_IP_SERVICES"
          ],
          "exclude": [
            "GLOBAL_PROTECT_CLOUD_VPN",
            "FORTICLIENT_VPN",
            "GLOBALPROTECT_VPN"
          ]
        },
        "asns": {
          "include": [
            395880,
            4637,
            63025,
            174,
            17252,
            3215,
            26042,
            197537,
            28110,
            212238,
            12586,
            215224,
            3257,
            48198,
            64286,
            135402,
            153494,
            36352,
            11426,
            23352,
            21769,
            394738,
            215071,
            204765,
            14670,
            62998,
            9009,
            27176,
            14956,
            55286,
            2516,
            215607,
            53667,
            136258,
            137409,
            199458,
            394727,
            203020,
            20001,
            214760,
            204708,
            23273,
            207043,
            215760,
            206533,
            207977
          ],
          "exclude": []
        }
      },
      "requestId": "00000000000000000000000000000074",
      "requestUri": "/api/v1/zones",
      "url": "/api/v1/zones?"
    }
  },
  "displayMessage": "Network zone mark as blacklist",
  "gatewayContext": null,
  "legacyEventType": "zone.make_blacklist",
  "resourceDetails": null,
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "trs00000000000000349",
    "externalSessionId": "trs00000000000000349"
  }
}

References #

zone.remove_blacklist

Description

Network zone unmark as blacklist.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Attempt to Modify an Okta Network Zone source medium: Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1484, T1562, T1562.007↳ also matches zone.update

References #

Okta Event Types Catalog: zone.remove_blacklist

zone.update

Description

Network zone update.

Example System Log Event #

{
  "actor": {
    "id": "00000000000000000000",
    "type": "User",
    "alternateId": "user@dw-harness.example",
    "displayName": "DW Harness",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "python-requests/2.34.2",
      "os": "Unknown",
      "browser": "UNKNOWN"
    },
    "zone": "null",
    "device": "Unknown",
    "id": null,
    "ipAddress": "203.0.113.10",
    "geographicalContext": {
      "city": "Anytown",
      "state": "Anystate",
      "country": "Placeholderland",
      "postalCode": "00000",
      "geolocation": {
        "lat": 0.0,
        "lon": 0.0
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "rootSessionId": "0000000000000000000000137",
    "externalSessionId": "00000000000000000000"
  },
  "displayMessage": "Network zone update",
  "eventType": "zone.update",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2026-07-02T18:54:59.940Z",
  "securityContext": {
    "asNumber": 0,
    "asOrg": "example-as-org",
    "isp": "example-isp",
    "domain": "example.com",
    "isProxy": false,
    "ipDetails": {
      "asNumber": 0,
      "asOrg": "example-as-org",
      "isp": "example-isp",
      "domain": "example.com"
    }
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "zoneData": {
        "type": "IP",
        "gateways": [
          {
            "type": "CIDR",
            "value": "203.0.113.10/24"
          }
        ],
        "proxies": []
      },
      "requestId": "00000000000000000000",
      "dtHash": "0000000000000000000000000000000000000000000000000000000000000000",
      "requestUri": "/api/v1/zones/nzo00000000000000015",
      "url": "/api/v1/zones/nzo00000000000000015?"
    }
  },
  "legacyEventType": "zone.update",
  "transaction": {
    "type": "WEB",
    "id": "00000000000000000000",
    "detail": {
      "rootApiTokenId": "00T00000000000000005",
      "requestApiTokenId": "00T00000000000000005"
    }
  },
  "uuid": "00000000-0000-0000-0000-000000000000",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "203.0.113.10",
        "geographicalContext": {
          "city": "Anytown",
          "state": "Anystate",
          "country": "Placeholderland",
          "postalCode": "00000",
          "geolocation": {
            "lat": 0.0,
            "lon": 0.0
          }
        },
        "version": "V4",
        "source": null,
        "ipDetails": {
          "asNumber": 0,
          "asOrg": "example-as-org",
          "isp": "example-isp",
          "domain": "example.com"
        }
      }
    ]
  },
  "target": [
    {
      "id": "00000000000000000000",
      "type": "NetworkZoneEntity",
      "alternateId": "user@dw-harness.example",
      "displayName": "DW Harness",
      "detailEntry": null
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Attempt to Modify an Okta Network Zone source medium: Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1484, T1562, T1562.007↳ also matches zone.remove_blacklist

References #

Okta Event Types Catalog: zone.update