Create okta_application_sign-on_policy_modified_or_deleted.yml

2021-09-12 20:27:45 -05:00
parent f759fff453
commit 249d3198d3
1 changed files with 22 additions and 0 deletions
@@ -0,0 +1,22 @@
+title: Okta Application Sign-On Policy Modified or Deleted
+id: Application Sign-On Policy
+description: Detects when an application Sign-on Policy is modified or deleted.
+author: Austin Songer
+status: experimental
+date: 2021/09/12
+references:
+    - https://developer.okta.com/docs/reference/api/system-log/
+    - https://developer.okta.com/docs/reference/api/event-types/
+logsource:
+  service: okta
+detection:
+    selection:
+        eventtype: 
+            - application.policy.sign_on.update
+            - application.policy.sign_on.rule.delete
+    condition: selection
+level: medium
+tags:
+    - attack.impact
+falsepositives:
+ - Unknown