Elastic medium stable kql
Attempt to Deactivate an Okta Policy Rule
Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls.
Detection Logic
data_stream.dataset:okta.system and event.action:policy.rule.deactivateFalse Positives
- ⚠ Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly deactivated in your organization.
Field Validations
Loading…
Comments (0)
Loading comments...