Detection rules › By event

Okta-application

Event	Rules
application.integration.rate_limit_exceeded	1
application.lifecycle.activate	1
application.lifecycle.create	1
application.lifecycle.deactivate	1
application.lifecycle.delete	2
application.lifecycle.update	4
application.policy.sign_on.rule.delete	3
application.policy.sign_on.update	3
application.user_membership.change_username	4
application.user_membership.show_password	1

application.integration.rate_limit_exceeded

1 detection rules reference this event. View event page.

Elastic (1)

Possible Okta DoS Attack severity medium T1498, T1499, T1499.002, T1499.003

application.lifecycle.activate

1 detection rules reference this event. View event page.

Panther (1)

Okta Org2Org application created of modified severity high T1078.004, T1556

application.lifecycle.create

1 detection rules reference this event. View event page.

Panther (1)

Okta Org2Org application created of modified severity high T1078.004, T1556

application.lifecycle.deactivate

1 detection rules reference this event. View event page.

Elastic (1)

Attempt to Deactivate an Okta Application severity low T1489

application.lifecycle.delete

2 detection rules reference this event. View event page.

Sigma (1)

Okta Application Modified or Deleted severity medium

Elastic (1)

Attempt to Delete an Okta Application severity low T1489

application.lifecycle.update

4 detection rules reference this event. View event page.

Sigma (1)

Okta Application Modified or Deleted severity medium

Elastic (1)

Attempt to Modify an Okta Application severity low

Panther (2)

Okta Cleartext Passwords Extracted via SCIM Application severity high T1556
Okta Org2Org application created of modified severity high T1078.004, T1556

application.policy.sign_on.rule.delete

3 detection rules reference this event. View event page.

Sigma (1)

Okta Application Sign-On Policy Modified or Deleted severity medium

Elastic (1)

Modification or Removal of an Okta Application Sign-On Policy severity medium T1556, T1556.009

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

application.policy.sign_on.update

3 detection rules reference this event. View event page.

Sigma (1)

Okta Application Sign-On Policy Modified or Deleted severity medium

Elastic (1)

Modification or Removal of an Okta Application Sign-On Policy severity medium T1556, T1556.009

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

application.user_membership.change_username

4 detection rules reference this event. View event page.

Panther (4)

Okta SWA Bulk Access, New Source, and Credential Extraction - Behavioral severity high T1078, T1213, T1555
Okta SWA Off-Hours Credential Access - Behavioral severity high T1078, T1555
Query.Okta.SWABulkAccessBehavioral
Query.Okta.SWAOffHoursAccessBehavioral

application.user_membership.show_password

1 detection rules reference this event. View event page.

Panther (1)

Okta Password Accessed severity medium T1552