Okta Identity Provider creation or modification
Set up the okta integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when an Okta Identity Provider has been created or modified.
Strategy
This rule monitors when an Okta Identity Provider has been created or modified. Okta’s security team reported a series of social engineering attacks in which attackers configured a second Identity Provider to act as an “impersonation app” to access applications within the compromised customer organization on behalf of other users.
Triage and response
- Contact the user
{{@usr.email}} to ensure the change {{@evt.name}} is authorized. - If the user was unaware of the change:
- Determine if any other activity occurred from this user. Look for deviations in user agents, IP addresses and network metadata.
- Begin your organization’s incident response process and investigate for any account takeovers.
