Detection rules › By event

Okta-app

Event	Rules
app.generic.unauth_app_access_attempt	4
app.oauth2.as.token.detect_reuse	1
app.oauth2.as.token.grant	1
app.oauth2.token.detect_reuse	1

app.generic.unauth_app_access_attempt

4 detection rules reference this event. View event page.

Sigma (1)

Okta Unauthorized Access to App severity medium

Elastic (1)

Unauthorized Access to an Okta Application severity low T1078, T1078.004

Splunk (1)

Okta Unauthorized Access to Application severity low T1087, T1087.004

Panther (1)

Okta App Unauthorized Access Attempt severity low

app.oauth2.as.token.detect_reuse

1 detection rules reference this event. View event page.

Panther (1)

Okta App Refresh Access Token Reuse severity medium

app.oauth2.as.token.grant

1 detection rules reference this event. View event page.

Elastic (1)

Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials severity medium T1078, T1078.004, T1550, T1550.001

app.oauth2.token.detect_reuse

1 detection rules reference this event. View event page.

Panther (1)

Okta App Refresh Access Token Reuse severity medium