Detection rules › By event

Okta-system

Event	Rules
system.agent.ad.config_change_detected	2
system.api_token.create	9
system.api_token.revoke	4
system.client.concurrency_rate_limit.violation	1
system.client.rate_limit.violation	1
system.email.account_unlock.sent_message	1
system.email.password_reset.sent_message	1
system.idp.lifecycle.activate	2
system.idp.lifecycle.create	4
system.idp.lifecycle.deactivate	2
system.idp.lifecycle.delete	2
system.idp.lifecycle.read_client_secret	1
system.idp.lifecycle.update	1
system.mfa.factor.deactivate	2
system.operation.rate_limit.violation	1
system.org.rate_limit.violation	2
system.org.rate_limit.warning	1
system.push.send_factor_verify_push	5
system.sms.send_account_unlock_message	1
system.sms.send_password_reset_message	1
system.voice.send_account_unlock_call	1
system.voice.send_password_reset_call	1

system.agent.ad.config_change_detected

2 detection rules reference this event. View event page.

Panther (2)

Okta AD Agent Token Abuse - Behavioral severity high T1098, T1528
Query.Okta.ADAgentTokenAbuseBehavioral

system.api_token.create

9 detection rules reference this event. View event page.

Sigma (1)

Okta API Token Created severity medium

Elastic (1)

Attempt to Create Okta API Token severity medium T1098, T1098.001, T1136

Splunk (1)

Okta New API Token Created severity medium T1078, T1078.001

Kusto (2)

High-Risk Admin Activity severity medium T1078, T1078.004, T1098
New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

YARA-L (1)

Okta New API Token Created severity medium T1078

Panther (3)

Okta AD Agent Token Abuse - Behavioral severity high T1098, T1528
Okta API Key Created severity informational T1528
Query.Okta.ADAgentTokenAbuseBehavioral

system.api_token.revoke

4 detection rules reference this event. View event page.

Sigma (1)

Okta API Token Revoked severity medium

Elastic (1)

Attempt to Revoke Okta API Token severity low T1531

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

Panther (1)

Okta API Key Revoked severity informational

system.client.concurrency_rate_limit.violation

1 detection rules reference this event. View event page.

Panther (1)

Okta Rate Limits severity low T1110, T1498

system.client.rate_limit.violation

1 detection rules reference this event. View event page.

Panther (1)

Okta Rate Limits severity low T1110, T1498

system.email.account_unlock.sent_message

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004

system.email.password_reset.sent_message

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004

system.idp.lifecycle.activate

2 detection rules reference this event. View event page.

Splunk (1)

Okta IDP Lifecycle Modifications severity low T1087, T1087.004

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.idp.lifecycle.create

4 detection rules reference this event. View event page.

Sigma (1)

Okta Identity Provider Created severity medium T1098, T1098.001

Elastic (1)

New Okta Identity Provider (IdP) Added by Admin severity medium T1484, T1484.002, T1556, T1556.007

Splunk (1)

Okta IDP Lifecycle Modifications severity low T1087, T1087.004

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.idp.lifecycle.deactivate

2 detection rules reference this event. View event page.

Splunk (1)

Okta IDP Lifecycle Modifications severity low T1087, T1087.004

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.idp.lifecycle.delete

2 detection rules reference this event. View event page.

Splunk (1)

Okta IDP Lifecycle Modifications severity low T1087, T1087.004

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.idp.lifecycle.read_client_secret

1 detection rules reference this event. View event page.

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.idp.lifecycle.update

1 detection rules reference this event. View event page.

Panther (1)

Okta Identity Provider Created or Modified severity high T1098, T1199, T1556

system.mfa.factor.deactivate

2 detection rules reference this event. View event page.

Kusto (1)

New Device/Location sign-in along with critical operation severity medium T1078, T1098, T1556

Panther (1)

Okta Support Reset Credential severity high T1199

system.operation.rate_limit.violation

1 detection rules reference this event. View event page.

Panther (1)

Okta Rate Limits severity low T1110, T1498

system.org.rate_limit.violation

2 detection rules reference this event. View event page.

Elastic (1)

Possible Okta DoS Attack severity medium T1498, T1499, T1499.002, T1499.003

Panther (1)

Okta Rate Limits severity low T1110, T1498

system.org.rate_limit.warning

1 detection rules reference this event. View event page.

Elastic (1)

Possible Okta DoS Attack severity medium T1498, T1499, T1499.002, T1499.003

system.push.send_factor_verify_push

5 detection rules reference this event. View event page.

Splunk (2)

Okta MFA Exhaustion Hunt T1110
Okta Mismatch Between Source and Response for Verify Push Request severity medium T1621

Kusto (1)

MFA Fatigue (OKTA) severity medium T1621

YARA-L (2)

Okta MFA Bruteforce Attack severity medium T1110
Okta Mismatch Between Source And Response For Verify Push Request severity medium T1621

system.sms.send_account_unlock_message

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004

system.sms.send_password_reset_message

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004

system.voice.send_account_unlock_call

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004

system.voice.send_password_reset_call

1 detection rules reference this event. View event page.

Elastic (1)

High Number of Okta User Password Reset or Unlock Attempts severity medium T1078, T1078.004