Every published rule

This rule detects access to Okta admin functions through proxy.

This rule detects when an user account is locked or suspended.

This rule detects when an Okta user session starts where the user is behind an anonymising proxy service.

This rule detects new user account creation

This rule detects when a new identity provider is created for Okta.

This rule detects when an user account is locked out.

This rule detects when an Policy Rule is Modified or Deleted.

This rule detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence

This rule detects when an application is modified or deleted.

This rule detects when a API token is created

This rule detects when unauthorized access to app occurs.

This rule detects when Okta flags new behavior in the Admin Console.

This rule detects when an Okta end-user reports behavior by their account as being potentially suspicious.

This rule detects when an Network Zone is Deactivated or Deleted.

This rule detects when an Okta policy is modified or deleted.

This rule detects when the Administrator role is assigned to an user or group.

This rule detects when Okta FastPass prevents a known phishing site.

This rule detects when an user assumed another user account.

This rule detects when an application Sign-on Policy is modified or deleted.

This rule detects when a security threat is detected in Okta.