Okta: API Token Creation via system.api_token.create event

Flags Okta API token creation events to support investigation of potential persistence.

FreeUnreviewedSigmamediumv1

okta-api-token-creation-via-system-api-token-create-event-19951c21

title: "Okta: API Token Creation via system.api_token.create event"
id: 7513be2c-a208-4ad7-9bee-79a9fd207dde
status: test
description: This rule identifies when an API token is created in Okta by matching the system.api_token.create event type. Attackers may create API tokens to maintain persistent access to Okta APIs without re-authenticating. Detection relies on Okta system log telemetry that records the API token creation event type.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_api_token_created.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.persistence
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: system.api_token.create
  condition: selection
falsepositives:
  - Legitimate creation of an API token by authorized users
level: medium
license: DRL-1.1
related:
  - id: 19951c21-229d-4ccb-8774-b993c3ff3c5c
    type: derived

What it detects

This rule identifies when an API token is created in Okta by matching the system.api_token.create event type. Attackers may create API tokens to maintain persistent access to Okta APIs without re-authenticating. Detection relies on Okta system log telemetry that records the API token creation event type.

Known false positives

Legitimate creation of an API token by authorized users

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.