Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
55
54
47
9
3
Contributors
49
37
36
17
8
Categories
44
40
37
34
33
Platforms
142
15
11
10
7
Products / Services
10,643
9,755
6,688
4,418
3,745
MITRE Techniques
70
62
53
52
32
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects when Okta FastPass prevents a known phishing site.
Detects when a new identity provider is created for Okta.
Detects when an Okta policy is modified or deleted.
Detects when an Policy Rule is Modified or Deleted.
Detects when unauthorized access to app occurs.
Detects when an user account is locked out.
Detects when an attempt at deactivating or resetting MFA.
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Detects when a API token is created
Detects when a API Token is revoked.
Detects when an application Sign-on Policy is modified or deleted.
Detects when an Network Zone is Deactivated or Deleted.
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
username field, which will cause the password to be retained in log files.
Detects when an security threat is detected in Okta.
Detects new user account creation
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
Detects Okta MFA device enrollment or life cycle changes that occur shortly after a successful authentication or password reset for the same user. This pattern is a strong indicator of a post-vishing account takeover, as seen in ShinyHunters campaigns.
This detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects events in Okta where there is the eventType of ~'policy.lifecycle' and the policy of 'OktaSignOn'.
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
Page 3 of 9