Okta: Detect API Token Revocation via system.api_token.revoke events

title: "Okta: Detect API Token Revocation via system.api_token.revoke events"
id: e26dbb06-f34a-4bdb-a370-89bcec64f43f
status: test
description: This rule identifies when an Okta API token is revoked by matching system.api_token.revoke events. Token revocation is a meaningful security change because it can indicate an attempted containment action after compromise or unauthorized token management. The detection relies on Okta System Log eventType telemetry for the specific token revoke event.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_api_token_revoked.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: system.api_token.revoke
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cf1dbc6b-6205-41b4-9b88-a83980d2255b
    type: derived