Anvilogic high experimental other

Okta: Policy Modified or Deleted [snowflake-okta]

This use case looks for when an OKTA policy has been modified or deleted.

View Source

Detection Logic

select * from okta where event_time > dateadd(hour, -2, sysdate()) and (event_type ilike 'policy.lifecycle.update' or event_type ilike 'policy.lifecycle.delete')

Field Validations

Loading…

Comments (0)

Loading comments...