Detection rules › By event

Okta-policy

Event	Rules
policy.evaluate_sign_on	8
policy.lifecycle.create	1
policy.lifecycle.deactivate	2
policy.lifecycle.delete	3
policy.lifecycle.update	5
policy.rule.deactivate	2
policy.rule.delete	3
policy.rule.update	5

policy.evaluate_sign_on

8 detection rules reference this event. View event page.

Sigma (1)

Okta New Admin Console Behaviours severity high T1078, T1078.004

Elastic (1)

Okta AiTM Session Cookie Replay severity high T1539, T1550, T1550.004

Splunk (2)

Kusto (1)

High-Risk Admin Activity severity medium T1078, T1078.004, T1098

YARA-L (2)

Okta Multiple Failed Requests To Access Applications severity medium T1550, T1550.004
Okta Suspicious Use Of A Session Cookie severity medium T1539

Panther (1)

Okta New Behaviors Acessing Admin Console severity high T1078.004

policy.lifecycle.create

1 detection rules reference this event. View event page.

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

policy.lifecycle.deactivate

2 detection rules reference this event. View event page.

Elastic (1)

Attempt to Deactivate an Okta Policy severity low T1556, T1556.006, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

policy.lifecycle.delete

3 detection rules reference this event. View event page.

Sigma (1)

Okta Policy Modified or Deleted severity low

Elastic (1)

Attempt to Delete an Okta Policy severity medium T1556, T1556.006, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

policy.lifecycle.update

5 detection rules reference this event. View event page.

Sigma (1)

Okta Policy Modified or Deleted severity low

Elastic (1)

Attempt to Modify an Okta Policy severity low T1484, T1556, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

Panther (2)

policy.rule.deactivate

2 detection rules reference this event. View event page.

Elastic (1)

Attempt to Deactivate an Okta Policy Rule severity medium T1556, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

policy.rule.delete

3 detection rules reference this event. View event page.

Sigma (1)

Okta Policy Rule Modified or Deleted severity medium

Elastic (1)

Attempt to Delete an Okta Policy Rule severity low T1484, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

policy.rule.update

5 detection rules reference this event. View event page.

Sigma (1)

Okta Policy Rule Modified or Deleted severity medium

Elastic (1)

Attempt to Modify an Okta Policy Rule severity low T1484, T1685, T1686.001

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556