Okta Application Lifecycle Update or Deletion Events
Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule flags Okta System Log events where an application is updated or deleted. Such lifecycle changes can indicate attacker-driven configuration tampering or removal of access paths to disrupt or conceal activity. It relies on Okta eventType telemetry for application lifecycle update and delete actions.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-application-lifecycle-update-or-deletion-7899144b
title: Okta Application Lifecycle Update or Deletion Events
id: e6135b2b-b25d-4557-9b7a-2edf9103563e
status: test
description: This rule flags Okta System Log events where an application is updated or deleted. Such lifecycle changes can indicate attacker-driven configuration tampering or removal of access paths to disrupt or conceal activity. It relies on Okta eventType telemetry for application lifecycle update and delete actions.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.impact
logsource:
product: okta
service: okta
detection:
selection:
eventType:
- application.lifecycle.update
- application.lifecycle.delete
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 7899144b-e416-4c28-b0b5-ab8f9e0a541d
type: derived