Anvilogic high experimental other

Okta: API Token Created_Deleted [snowflake-okta]

This use-case will detect when API tokens are created or deleted in Okta

View Source

Detection Logic

select * from okta where event_time > dateadd(hour, -2, sysdate()) and (event_type ilike 'system.api_token.create' or event_type ilike 'system.api_token.revoke')

Field Validations

Loading…

Comments (0)

Loading comments...