Okta New API Token Created

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•34

This rule detects the creation of a new API token within the Okta identity platform. API tokens can be used for programmatic access to Okta and, if compromised, can lead to unauthorized access, persistence, or privilege escalation. The rule specifically looks for 'system.api_token.create' events with a successful 'ALLOW' action.