Sample rules
Attempt to Modify an Okta Network Zone
- source: elastic
- technicques:
- T1562
Description
Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization’s security controls.
Detection logic
event.dataset:okta.system and event.action:(zone.update or network_zone.rule.disabled or zone.remove_blacklist)
Attempt to Delete an Okta Network Zone
- source: elastic
- technicques:
- T1562
Description
Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization’s security controls.
Detection logic
event.dataset:okta.system and event.action:zone.delete