Okta policy rule deleted

okta

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

Set up the okta integration.

Goal

Detect when an Okta policy rule is deleted.

Strategy

This rule lets you monitor the following Okta event to detect when a policy rule is deleted:

  • policy.rule.delete

Triage and response

  1. Contact the Okta administrator to confirm that the user: {{@usr.email}} should be deleting policy rules.
  2. If the change was not authorized, verify there are no other signals from the user: {{@usr.email}}.