Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
Flags Okta System Log events when a Network Zone is deactivated or deleted.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule flags Okta system log events indicating a Network Zone was deactivated or deleted. Attackers may attempt to weaken access controls or alter network-based policies by removing or disabling zones. The detection relies on Okta eventType telemetry for zone.deactivate and zone.delete.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-network-zone-deactivated-or-deleted-9f308120
title: Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
id: 2fd55157-82ee-4ca6-8928-8abfe7c8bcd0
status: test
description: This rule flags Okta system log events indicating a Network Zone was deactivated or deleted. Attackers may attempt to weaken access controls or alter network-based policies by removing or disabling zones. The detection relies on Okta eventType telemetry for zone.deactivate and zone.delete.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_network_zone_deactivated_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.impact
logsource:
product: okta
service: okta
detection:
selection:
eventType:
- zone.deactivate
- zone.delete
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9f308120-69ed-4506-abde-ac6da81f4310
type: derived