Detection rules › Sigma
Okta Identity Provider Created
Detects when a new identity provider is created for Okta.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098.001 Account Manipulation: Additional Cloud Credentials |
| Privilege Escalation | T1098.001 Account Manipulation: Additional Cloud Credentials |
Event coverage
| Provider | Event |
|---|---|
| Okta-system | system.idp.lifecycle.create |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body yaml
title: Okta Identity Provider Created
id: 969c7590-8c19-4797-8c1b-23155de6e7ac
status: test
description: Detects when a new identity provider is created for Okta.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
author: kelnage
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1098.001
logsource:
product: okta
service: okta
detection:
selection:
eventType: 'system.idp.lifecycle.create'
condition: selection
falsepositives:
- When an admin creates a new, authorised identity provider.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventType: 'system.idp.lifecycle.create'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventType | eq |
|