Modification or Removal of an Okta Application Sign-On Policy
Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/07/01"
3integration = ["okta"]
4maturity = "production"
5updated_date = "2024/12/09"
6min_stack_version = "8.15.0"
7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or
13delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls.
14"""
15false_positives = [
16 """
17 Consider adding exceptions to this rule to filter false positives if sign on policies for Okta applications are
18 regularly modified or deleted in your organization.
19 """,
20]
21index = ["filebeat-*", "logs-okta*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Modification or Removal of an Okta Application Sign-On Policy"
25note = """## Setup
26
27The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
28references = [
29 "https://help.okta.com/en/prod/Content/Topics/Security/App_Based_Signon.htm",
30 "https://developer.okta.com/docs/reference/api/system-log/",
31 "https://developer.okta.com/docs/reference/api/event-types/",
32 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33 "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
34 "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
35]
36risk_score = 47
37rule_id = "cd16fb10-0261-46e8-9932-a0336278cdbe"
38severity = "medium"
39tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:okta.system and event.action:(application.policy.sign_on.update or application.policy.sign_on.rule.delete)
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1556"
52name = "Modify Authentication Process"
53reference = "https://attack.mitre.org/techniques/T1556/"
54
55
56[rule.threat.tactic]
57id = "TA0003"
58name = "Persistence"
59reference = "https://attack.mitre.org/tactics/TA0003/"
Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
-
-
-
Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs
Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.
Read More -
This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.
Read More -
This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.
Read More
Related rules
- Administrator Privileges Assigned to an Okta Group
- Administrator Role Assigned to an Okta User
- Attempt to Create Okta API Token
- Attempt to Reset MFA Factors for an Okta User Account
- MFA Deactivation with no Re-Activation for Okta User Account