Anvilogic high experimental spl

Okta: API Token Created_Deleted [splunk-okta]

This use-case will detect when API tokens are created or deleted in Okta

View Source

Detection Logic

`get_application_data` (eventType="system.api_token.create" 
OR eventType="system.api_token.revoke")
| eval request_parameter='target{}.displayName', request_type='target{}.type'
| table _time, host, user, action, dest_host, src_ip, src_user, signature, request_*
| bin span=1s
| stats values(*) as * by _time, src_ip

Field Validations

Loading…

Comments (0)

Loading comments...