okta Sigma detection rules

Detects when Okta FastPass prevents a known phishing site.

okta · okta

Detects when Okta identifies new activity in the Admin Console.

okta · okta

Detects when an Okta end-user reports activity by their account as being potentially suspicious.

okta · okta

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

okta · okta

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

okta · okta

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

okta · okta

Detects access to Okta admin functions through proxy.

okta · okta

Detects when an the Administrator role is assigned to an user or group.

okta · okta

Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

okta · okta

Detects when a API token is created

okta · okta

Detects when a API Token is revoked.

okta · okta

Detects when an application is modified or deleted.

okta · okta

Detects when an application Sign-on Policy is modified or deleted.

okta · okta

Detects when a new identity provider is created for Okta.

okta · okta

Detects when an attempt at deactivating or resetting MFA.

okta · okta

Detects when an Network Zone is Deactivated or Deleted.

okta · okta

Detects when an Policy Rule is Modified or Deleted.

okta · okta

Detects when an security threat is detected in Okta.

okta · okta

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session. This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account. Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user. Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

okta · okta

Detects when unauthorized access to app occurs.

okta · okta

Detects when an user account is locked out.

okta · okta

Detects all activities against the endpoint "/reports/password-health/*" which should only be accessed via OKTA Admin Console UI. Use this rule to hunt for potential suspicious requests. Correlate this event with "admin console" login and alert on requests without any corresponding admin console login

okta · okta

Detects when an Okta policy is modified or deleted.

okta · okta

Detects new user account creation

okta · okta