Okta: Detect API token revocation events
Flags Okta API token revocations using system.api_token.revoke System Log events.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule identifies when an Okta API token is revoked, based on the system event type system.api_token.revoke. Token revocation is security-relevant because it can indicate response to compromise, administrative changes, or attacker attempts to disrupt access. The detection relies on Okta system log telemetry containing the eventType field for API token revocations.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-detect-api-token-revocation-via-system-api-token-revoke-events-cf1dbc6b
title: "Okta: Detect API token revocation events"
id: e26dbb06-f34a-4bdb-a370-89bcec64f43f
status: test
description: This rule identifies when an Okta API token is revoked, based on the system event type system.api_token.revoke. Token revocation is security-relevant because it can indicate response to compromise, administrative changes, or attacker attempts to disrupt access. The detection relies on Okta system log telemetry containing the eventType field for API token revocations.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_api_token_revoked.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.impact
logsource:
product: okta
service: okta
detection:
selection:
eventType: system.api_token.revoke
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: cf1dbc6b-6205-41b4-9b88-a83980d2255b
type: derived