huntrule

Okta Application Lifecycle Update or Deletion

Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.

FreeUnreviewedSigmamediumv1
title: Okta Application Lifecycle Update or Deletion
id: e6135b2b-b25d-4557-9b7a-2edf9103563e
status: test
description: This rule flags Okta System Log events where an application lifecycle update or delete occurs. Attackers may modify application settings or remove an application to disrupt access, change integrations, or reduce evidence after actions in the environment. Detection relies on Okta eventType telemetry for application.lifecycle.update and application.lifecycle.delete entries in the system log.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - application.lifecycle.update
      - application.lifecycle.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7899144b-e416-4c28-b0b5-ab8f9e0a541d
    type: derived

What it detects

This rule flags Okta System Log events where an application lifecycle update or delete occurs. Attackers may modify application settings or remove an application to disrupt access, change integrations, or reduce evidence after actions in the environment. Detection relies on Okta eventType telemetry for application.lifecycle.update and application.lifecycle.delete entries in the system log.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.