huntrule

Okta Policy Rule Updated or Deleted via Policy Rule API Events

Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.

FreeUnreviewedSigmamediumv1
title: Okta Policy Rule Updated or Deleted via Policy Rule API Events
id: 75190378-ce62-441f-8494-6ff9ee9e8ff9
status: test
description: This rule flags Okta system log events where a policy rule is either updated or deleted. Attackers may use changes to policy rules to weaken access controls, alter enforcement behavior, or remove safeguards. The detection relies on Okta eventType telemetry for policy.rule.update and policy.rule.delete.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_policy_rule_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - policy.rule.update
      - policy.rule.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0c97c1d3-4057-45c9-b148-1de94b631931
    type: derived

What it detects

This rule flags Okta system log events where a policy rule is either updated or deleted. Attackers may use changes to policy rules to weaken access controls, alter enforcement behavior, or remove safeguards. The detection relies on Okta eventType telemetry for policy.rule.update and policy.rule.delete.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.