Okta System Log: New Identity Provider Created via system.idp.lifecycle.create
Alerts on Okta events indicating a new identity provider was created.
- Product
- okta
- Service
- okta
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Okta system events where an identity provider is newly created (eventType system.idp.lifecycle.create). Creating a new IdP can enable attacker-controlled authentication paths and support persistence or privilege escalation by establishing new trust relationships. It relies on Okta system log telemetry capturing identity provider lifecycle events, including the event type indicating creation.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Okta System Log: New Identity Provider Created via system.idp.lifecycle.create"
id: d749ed57-c1b9-4dbd-93d4-131297a1016e
status: test
description: This rule flags Okta system events where an identity provider is newly created (eventType system.idp.lifecycle.create). Creating a new IdP can enable attacker-controlled authentication paths and support persistence or privilege escalation by establishing new trust relationships. It relies on Okta system log telemetry capturing identity provider lifecycle events, including the event type indicating creation.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_identity_provider_created.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1098.001
logsource:
product: okta
service: okta
detection:
selection:
eventType: system.idp.lifecycle.create
condition: selection
falsepositives:
- When an admin creates a new, authorised identity provider.
level: medium
license: DRL-1.1
related:
- id: 969c7590-8c19-4797-8c1b-23155de6e7ac
type: derived