Attempt to Modify an Okta Application

calendar Dec 9, 2024 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact  ·
Share on: linkedin copy

Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/06"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/12/09"
 6min_stack_version = "8.15.0"
 7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta
13application in order to weaken an organization's security controls or disrupt their business operations.
14"""
15false_positives = [
16    """
17    Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are
18    regularly modified and the behavior is expected.
19    """,
20]
21index = ["filebeat-*", "logs-okta*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Attempt to Modify an Okta Application"
25note = """## Setup
26
27The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
28references = [
29    "https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Apps.htm",
30    "https://developer.okta.com/docs/reference/api/system-log/",
31    "https://developer.okta.com/docs/reference/api/event-types/",
32    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
34    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
35]
36risk_score = 21
37rule_id = "c74fd275-ab2c-4d49-8890-e2943fa65c09"
38severity = "low"
39tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Impact"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:okta.system and event.action:application.lifecycle.update
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50
51[rule.threat.tactic]
52id = "TA0040"
53name = "Impact"
54reference = "https://attack.mitre.org/tactics/TA0040/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top