Attempt to Delete an Okta Network Zone

calendar Sep 25, 2024 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion  ·
Share on: linkedin copy

Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/06"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a
11network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network
12zone in order to remove or weaken an organization's security controls.
13"""
14false_positives = [
15    """
16    Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are
17    regularly deleted.
18    """,
19]
20index = ["filebeat-*", "logs-okta*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "Attempt to Delete an Okta Network Zone"
24note = """## Triage and analysis
25
26### Investigating Attempt to Delete an Okta Network Zone
27
28Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.
29
30#### Possible investigation steps:
31
32- Identify the actor associated with the alert by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.
33- Examine the `event.action` field to confirm the deletion of a network zone.
34- Investigate the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` fields to identify the network zone that was deleted.
35- Review the `event.time` field to understand when the event happened.
36- Check the actor's activities before and after the event to understand the context of this event.
37
38### False positive analysis:
39
40- Verify the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.
41- Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.
42- Cross-verify the actor's actions with any known planned changes or maintenance activities.
43
44### Response and remediation:
45
46- If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.
47- If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.
48- Review and update the privileges of the actor who initiated the deletion.
49- Identify any gaps in the security policies and procedures and update them as necessary.
50- Implement additional monitoring and logging of Okta events to improve visibility of user actions.
51- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.
52
53## Setup
54
55The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
56references = [
57    "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
58    "https://developer.okta.com/docs/reference/api/system-log/",
59    "https://developer.okta.com/docs/reference/api/event-types/",
60    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
61    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
62    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
63]
64risk_score = 47
65rule_id = "c749e367-a069-4a73-b1f2-43a3798153ad"
66severity = "medium"
67tags = [
68    "Use Case: Identity and Access Audit",
69    "Data Source: Okta",
70    "Use Case: Network Security Monitoring",
71    "Tactic: Defense Evasion",
72]
73timestamp_override = "event.ingested"
74type = "query"
75
76query = '''
77event.dataset:okta.system and event.action:zone.delete
78'''
79
80
81[[rule.threat]]
82framework = "MITRE ATT&CK"
83[[rule.threat.technique]]
84id = "T1562"
85name = "Impair Defenses"
86reference = "https://attack.mitre.org/techniques/T1562/"
87[[rule.threat.technique.subtechnique]]
88id = "T1562.007"
89name = "Disable or Modify Cloud Firewall"
90reference = "https://attack.mitre.org/techniques/T1562/007/"
91
92
93
94[rule.threat.tactic]
95id = "TA0005"
96name = "Defense Evasion"
97reference = "https://attack.mitre.org/tactics/TA0005/"

Triage and analysis

Investigating Attempt to Delete an Okta Network Zone

Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.

Possible investigation steps:

  • Identify the actor associated with the alert by examining the okta.actor.id, okta.actor.type, okta.actor.alternate_id, or okta.actor.display_name fields.
  • Examine the event.action field to confirm the deletion of a network zone.
  • Investigate the okta.target.id, okta.target.type, okta.target.alternate_id, or okta.target.display_name fields to identify the network zone that was deleted.
  • Review the event.time field to understand when the event happened.
  • Check the actor's activities before and after the event to understand the context of this event.

False positive analysis:

  • Verify the okta.client.user_agent.raw_user_agent field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.
  • Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.
  • Cross-verify the actor's actions with any known planned changes or maintenance activities.

Response and remediation:

  • If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.
  • If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.
  • Review and update the privileges of the actor who initiated the deletion.
  • Identify any gaps in the security policies and procedures and update them as necessary.
  • Implement additional monitoring and logging of Okta events to improve visibility of user actions.
  • Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top