Okta System API Token Creation Events
Flags Okta API token creation events to support investigation of potential persistence.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule identifies Okta System Log events where an API token is created (eventType system.api_token.create). Creating an API token can enable persistent access for automation or integrations and may be abused for unauthorized API usage. Detection relies on Okta event telemetry from the system log that records token creation actions.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-api-token-creation-via-system-api-token-create-event-19951c21
title: Okta System API Token Creation Events
id: 7513be2c-a208-4ad7-9bee-79a9fd207dde
status: test
description: This rule identifies Okta System Log events where an API token is created (eventType system.api_token.create). Creating an API token can enable persistent access for automation or integrations and may be abused for unauthorized API usage. Detection relies on Okta event telemetry from the system log that records token creation actions.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_api_token_created.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.persistence
logsource:
product: okta
service: okta
detection:
selection:
eventType: system.api_token.create
condition: selection
falsepositives:
- Legitimate creation of an API token by authorized users
level: medium
license: DRL-1.1
related:
- id: 19951c21-229d-4ccb-8774-b993c3ff3c5c
type: derived