Okta: Detect security.threat.detected events in threat insight
Flags Okta System Log security.threat.detected events indicating a detected potential security threat.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule matches Okta System Log events with eventType equal to security.threat.detected. Such events indicate that Okta’s Threat Insight has flagged a potential security threat, which attackers may attempt to trigger or evade. Detection relies on the presence of the eventType field in Okta telemetry from the System Log.
Reporting behind it
- okta.github.iohttps://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
- developer.okta.comhttps://developer.okta.com/docs/reference/api/system-log/
- developer.okta.comhttps://developer.okta.com/docs/reference/api/event-types/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_security_threat_detected.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-detects-security-threat-detected-events-from-threat-insight-5c82f0b9
title: "Okta: Detect security.threat.detected events in threat insight"
id: 2f0756b4-7e23-4b15-a1c8-09623b16c87d
status: test
description: This rule matches Okta System Log events with eventType equal to security.threat.detected. Such events indicate that Okta’s Threat Insight has flagged a potential security threat, which attackers may attempt to trigger or evade. Detection relies on the presence of the eventType field in Okta telemetry from the System Log.
references:
- https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_security_threat_detected.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.command-and-control
logsource:
product: okta
service: okta
detection:
selection:
eventType: security.threat.detected
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 5c82f0b9-3c6d-477f-a318-0e14a1df73e0
type: derived