huntrule

Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete

Flags Okta System Log events when a Network Zone is deactivated or deleted.

FreeReviewedSigma · Medium · v4
Product
okta
Service
okta
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-09-12
Updated
2026-07-31
AnalysisDetection
title: Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
id: 2fd55157-82ee-4ca6-8928-8abfe7c8bcd0
status: test
description: This rule flags Okta system log events indicating a Network Zone was deactivated or deleted. Attackers may attempt to weaken access controls or alter network-based policies by removing or disabling zones. The detection relies on Okta eventType telemetry for zone.deactivate and zone.delete.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_network_zone_deactivated_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - zone.deactivate
      - zone.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9f308120-69ed-4506-abde-ac6da81f4310
    type: derived