David French f438a222d5 [New Rule] Attempt to Modify or Delete Okta Application Sign On Policy (#10) ...

* Add okta rule for policy modification/delete

* Update rule name

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

* Update rules/okta/okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Add event.module value to query

* Update okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

Add event.category and event.type values to query

* Update rules/okta/okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

2020-07-02 08:52:55 -06:00

..

credential_access_attempted_bypass_of_okta_mfa.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

impact_attempt_to_revoke_okta_api_token.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

impact_possible_okta_dos_attack.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

initial_access_suspicious_activity_reported_by_okta_user.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_deactivate_okta_mfa_rule.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_delete_okta_policy.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_modify_okta_mfa_rule.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_modify_okta_network_zone.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_modify_okta_policy.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

okta_attempt_to_modify_or_delete_application_sign_on_policy.toml

[New Rule] Attempt to Modify or Delete Okta Application Sign On Policy (#10)

2020-07-02 08:52:55 -06:00

okta_threat_detected_by_okta_threatinsight.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

persistence_administrator_privileges_assigned_to_okta_group.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

persistence_attempt_to_create_okta_api_token.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

persistence_attempt_to_deactivate_mfa_for_okta_user_account.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

persistence_attempt_to_deactivate_okta_policy.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00

persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml

Populate rules/ directory.

2020-06-29 22:57:03 -06:00