when an admin creates a new, authorised identity provider.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/okta/okta_identity_provider_created.yml>sigma
technicques: t1098 t1098.001

Techniques

Detects when a new identity provider is created for Okta.

condition: selection
selection:
  eventtype: system.idp.lifecycle.create