huntrule

Okta: Detects security.threat.detected events from Threat Insight

Flags Okta System Log security.threat.detected events indicating a detected potential security threat.

FreeUnreviewedSigmamediumv1
title: "Okta: Detects security.threat.detected events from Threat Insight"
id: 2f0756b4-7e23-4b15-a1c8-09623b16c87d
status: test
description: This rule matches Okta System Log events with eventType security.threat.detected. Such alerts indicate Okta identified a potential security threat, which attackers may attempt to trigger through suspicious authentication or account activity. The detection relies on Okta System Log telemetry, specifically the eventType field for Threat Insight detections.
references:
  - https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_security_threat_detected.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.command-and-control
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: security.threat.detected
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5c82f0b9-3c6d-477f-a318-0e14a1df73e0
    type: derived

What it detects

This rule matches Okta System Log events with eventType security.threat.detected. Such alerts indicate Okta identified a potential security threat, which attackers may attempt to trigger through suspicious authentication or account activity. The detection relies on Okta System Log telemetry, specifically the eventType field for Threat Insight detections.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.