Okta Network Zone Deactivated or Deleted

title: Okta Network Zone Deactivated or Deleted
id: 2fd55157-82ee-4ca6-8928-8abfe7c8bcd0
status: test
description: This rule identifies Okta events where a Network Zone is deactivated or deleted. Attackers or administrators may use zone changes to weaken access controls, bypass network-based policies, or remove safeguards. The detection relies on Okta System Log eventType values for zone.deactivate and zone.delete.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_network_zone_deactivated_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - zone.deactivate
      - zone.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9f308120-69ed-4506-abde-ac6da81f4310
    type: derived