Okta Sign-On Policy Updated or Rule Deleted
Flags Okta sign-on policy updates and sign-on rule deletions in application policies.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-12
- Updated
- 2026-07-31
What it detects
This rule flags Okta events where an application sign-on policy is modified or a sign-on policy rule is deleted. Such changes can alter authentication requirements or remove controls, enabling account access or weakening enforcement. It relies on Okta system log event types for sign-on policy updates and rule deletions.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-sign-on-policy-update-or-rule-deletion-8f668cc4
title: Okta Sign-On Policy Updated or Rule Deleted
id: 80212993-ddc8-460a-872c-ade548e54851
status: test
description: This rule flags Okta events where an application sign-on policy is modified or a sign-on policy rule is deleted. Such changes can alter authentication requirements or remove controls, enabling account access or weakening enforcement. It relies on Okta system log event types for sign-on policy updates and rule deletions.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
- attack.impact
logsource:
product: okta
service: okta
detection:
selection:
eventType:
- application.policy.sign_on.update
- application.policy.sign_on.rule.delete
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 8f668cc4-c18e-45fe-ad00-624a981cf88a
type: derived