Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when an Okta policy rule is deleted.

Strategy

This rule lets you monitor the following Okta event to detect when a policy rule is deleted:

• policy.rule.delete

Triage and response

1. Contact the Okta administrator to confirm that the user: {{@usr.email}} should be deleting policy rules.
2. If the change was not authorized, verify there are no other signals from the user: {{@usr.email}}.