Okta Policy Lifecycle Update or Deletion Events

Flags Okta events indicating a policy was updated or deleted.

FreeUnreviewedSigmalowv1

okta-policy-lifecycle-update-or-deletion-events-1667a172

title: Okta Policy Lifecycle Update or Deletion Events
id: ac440928-793c-4461-a6c4-8989b582edd6
status: test
description: This rule identifies Okta System Log events where a policy is modified or deleted. Attackers may attempt to weaken enforcement or remove controls by changing policy lifecycle states, making these events high-signal for impact and governance monitoring. It relies on Okta eventType telemetry for policy.lifecycle.update and policy.lifecycle.delete.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_policy_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - policy.lifecycle.update
      - policy.lifecycle.delete
  condition: selection
falsepositives:
  - Okta Policies being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 1667a172-ed4c-463c-9969-efd92195319a
    type: derived

What it detects

This rule identifies Okta System Log events where a policy is modified or deleted. Attackers may attempt to weaken enforcement or remove controls by changing policy lifecycle states, making these events high-signal for impact and governance monitoring. It relies on Okta eventType telemetry for policy.lifecycle.update and policy.lifecycle.delete.

Known false positives

Okta Policies being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.