huntrule

Okta Application Lifecycle Update or Deletion Events

Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.

FreeReviewedSigma · Medium · v4
Product
okta
Service
okta
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-09-12
Updated
2026-07-31
AnalysisDetection
title: Okta Application Lifecycle Update or Deletion Events
id: e6135b2b-b25d-4557-9b7a-2edf9103563e
status: test
description: This rule flags Okta System Log events where an application is updated or deleted. Such lifecycle changes can indicate attacker-driven configuration tampering or removal of access paths to disrupt or conceal activity. It relies on Okta eventType telemetry for application lifecycle update and delete actions.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - application.lifecycle.update
      - application.lifecycle.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7899144b-e416-4c28-b0b5-ab8f9e0a541d
    type: derived