diff --git a/rules/cloud/okta/okta_policy_modified_or_deleted.yml b/rules/cloud/okta/okta_policy_modified_or_deleted.yml index 494af5b50..2e72accd1 100644 --- a/rules/cloud/okta/okta_policy_modified_or_deleted.yml +++ b/rules/cloud/okta/okta_policy_modified_or_deleted.yml @@ -11,7 +11,7 @@ logsource: service: okta detection: selection: - displaymessge: + eventtype: - policy.lifecycle.update - policy.lifecycle.delete condition: selection