Attempt to Delete an Okta Applicationedit
Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization’s security controls or disrupt their business operations.
Rule type: query
Rule indices:
- filebeat-*
- logs-okta*
Severity: low
Risk score: 21
Runs every: 5m
Searches indices from: None (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Use Case: Identity and Access Audit
- Data Source: Okta
- Tactic: Impact
Version: 205
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guideedit
Setupedit
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
Rule queryedit
event.dataset:okta.system and event.action:application.lifecycle.delete
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
-
Technique:
- Name: Service Stop
- ID: T1489
- Reference URL: https://attack.mitre.org/techniques/T1489/