huntrule

Okta Sign-On Policy Updated or Rule Deleted

Flags Okta sign-on policy updates and sign-on rule deletions in application policies.

FreeReviewedSigma · Medium · v4
Product
okta
Service
okta
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-09-12
Updated
2026-07-31
AnalysisDetection
title: Okta Sign-On Policy Updated or Rule Deleted
id: 80212993-ddc8-460a-872c-ade548e54851
status: test
description: This rule flags Okta events where an application sign-on policy is modified or a sign-on policy rule is deleted. Such changes can alter authentication requirements or remove controls, enabling account access or weakening enforcement. It relies on Okta system log event types for sign-on policy updates and rule deletions.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - application.policy.sign_on.update
      - application.policy.sign_on.rule.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8f668cc4-c18e-45fe-ad00-624a981cf88a
    type: derived