Files
blue-team-tools/rules/identity/okta/okta_application_modified_or_deleted.yml
T
Nasreddine Bencherchali 3a20687cad Merge PR #5738 from @nasbench - rename folders and update readme
chore: rename folders and update readme
2025-11-03 10:35:44 +01:00

26 lines
652 B
YAML

title: Okta Application Modified or Deleted
id: 7899144b-e416-4c28-b0b5-ab8f9e0a541d
status: test
description: Detects when an application is modified or deleted.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
author: Austin Songer @austinsonger
date: 2021-09-12
modified: 2022-10-09
tags:
- attack.impact
logsource:
product: okta
service: okta
detection:
selection:
eventtype:
- application.lifecycle.update
- application.lifecycle.delete
condition: selection
falsepositives:
- Unknown
level: medium