Okta: Unauthorized App Access Attempt via System Log Display Message

title: "Okta: Unauthorized App Access Attempt via System Log Display Message"
id: 99c1f69e-87f3-4da8-869f-120dc25edb95
status: test
description: This rule flags Okta events where the system log contains the message indicating a user attempted unauthorized access to an app. Attackers may probe apps they are not allowed to reach, and these attempts can indicate credential misuse or access-enumeration activity. Detection relies on Okta system log telemetry, specifically the event’s displayMessage text matching the unauthorized access attempt message.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_unauthorized_access_to_app.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    displayMessage: User attempted unauthorized access to app
  condition: selection
falsepositives:
  - User might of believe that they had access.
level: medium
license: DRL-1.1
related:
  - id: 6cc2b61b-d97e-42ef-a9dd-8aa8dc951657
    type: derived