Search and filter across all detection sources
258 rules
Okta: Profile Updated [snowflake-okta]
Okta user profile updated
Okta: Profile Updated [splunk-okta]
Okta: User Created [snowflake-okta]
Okta user account creation
Okta: User Created [splunk-okta]
Okta API Key Revoked
A user has revoked an API Key in Okta
Okta: Multiple OKTA push requests [snowflake-okta]
This use case looks for when a user has received multiple push requests for authentication via Okta.
Okta: Multiple OKTA push requests [splunk-okta]
[DYNAMIC] Okta Logs Detected
Okta: Application Modified or Deleted [snowflake-okta]
This use case looks for updates or removals of OKTA applications
Okta: Admin App Accessed [snowflake-okta]
This use case detects when a user has accessed the Okta admin app.
Okta: Admin App Accessed [splunk-okta]
Okta ThreatInsight Suspected Bruteforce Attack
Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.
Okta Admin Role Assigned
A user has been granted administrative privileges in Okta
Okta User Account Locked
An Okta user has locked their account.
Okta: User impersonation [snowflake-okta]
User.session.impersonation events are normally triggered when an Okta Support person requests admin access.
Okta: User impersonation [splunk-okta]
Okta API Key Created
A user created an API Key in Okta
Okta Fast Pass phishing Detection
This query detects cases in which Okta FastPass effectively prevented access to a known phishing website.
[OKTA] BRUTE FORCE ATTEMPT [1]
[OKTA] BRUTE FORCE ATTEMPT [2]
[OKTA] REQUEST FROM SUSPICIOUS ACTOR
Okta: Policy Modified or Deleted [snowflake-okta]
This use case looks for when an OKTA policy has been modified or deleted.
Okta Support Reset Credential
A Password or MFA factor was reset by Okta Support
Okta FastPass Phishing Detection
Detects when Okta FastPass prevents a known phishing site.
Okta Security Threat Detected
Detects when an security threat is detected in Okta.