Okta User Lifecycle Create Event for New User Accounts

Flags Okta events indicating new user account creation via user.lifecycle.create.

FreeUnreviewedSigmainformationalv1

okta-user-lifecycle-create-event-for-new-user-accounts-b6c718dd

title: Okta User Lifecycle Create Event for New User Accounts
id: 69480783-3cd8-4d7a-8cdd-15dfa37fa982
status: test
description: This rule identifies Okta events where a new user account is created (eventType user.lifecycle.create). Creating accounts is a common step for account provisioning, but it can also indicate unauthorized access attempts when attackers add new identities. The detection relies on Okta service telemetry containing the eventType field for lifecycle events.
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
modified: 2026-04-27
references:
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_user_created.yml
tags:
  - attack.credential-access
logsource:
  service: okta
  product: okta
detection:
  selection:
    eventType: user.lifecycle.create
  condition: selection
falsepositives:
  - Legitimate and authorized user creation
level: informational
license: DRL-1.1
related:
  - id: b6c718dd-8f53-4b9f-98d8-93fdca966969
    type: derived

What it detects

This rule identifies Okta events where a new user account is created (eventType user.lifecycle.create). Creating accounts is a common step for account provisioning, but it can also indicate unauthorized access attempts when attackers add new identities. The detection relies on Okta service telemetry containing the eventType field for lifecycle events.

Known false positives

Legitimate and authorized user creation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.