huntrule

Okta Policy Rule Updated or Deleted

Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.

FreeReviewedSigma · Medium · v4
Product
okta
Service
okta
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-09-12
Updated
2026-07-31
AnalysisDetection
title: Okta Policy Rule Updated or Deleted
id: 75190378-ce62-441f-8494-6ff9ee9e8ff9
status: test
description: This rule flags Okta System Log events where a policy rule is modified or deleted. Attackers may change or remove access control rules to weaken enforcement or disrupt authentication and authorization policies. The detection relies on Okta event types for policy.rule.update and policy.rule.delete in the System Log telemetry.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_policy_rule_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - policy.rule.update
      - policy.rule.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0c97c1d3-4057-45c9-b148-1de94b631931
    type: derived