okta:systemlog
Okta System Log
- Host type
- Identity providers and SaaS (Okta, GitHub, Slack, ...)
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 18
- Rules listed
- 114
- Events
- 39
Why this tier
CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis)
Licensing
- License or service
- Okta Workforce Identity (all SKUs implied)
- What is free
- UI/API; 90-day retention
- What costs
- Nothing stated
- Notes
- Pricing page lists no log SKU gating; SKU inclusion UNCONFIRMED
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: actor on every event |
| OMB M-26-14: Privilege changes | Supports an activity | our analysis: admin role grants |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted (cloud): authentication success and/or failures to third party services (e.g. SAML/OAuth) |
Techniques
- T1021.007 Cloud Services
- T1036.010 Masquerade Account Name
- T1059.009 Cloud API
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1087 Account Discovery
- T1087.004 Cloud Account
- T1098 Account Manipulation
- T1531 Account Access Removal
- T1538 Cloud Service Dashboard
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1552.008 Chat Messages
- T1556.007 Hybrid Identity
- T1556.009 Conditional Access Policies
- T1621 Multi-Factor Authentication Request Generation
- T1684 Social Engineering
- T1687 Exploitation for Defense Impairment
Rules
Splunk 21
- Geographic Improbable Location
- Okta Authentication Failed During MFA Challenge
- Okta IDP Lifecycle Modifications
- Okta MFA Exhaustion Hunt
- Okta Mismatch Between Source and Response for Verify Push Request
- Okta Multi-Factor Authentication Disabled
- Okta Multiple Accounts Locked Out
- Okta Multiple Failed MFA Requests For User
- Okta Multiple Failed Requests to Access Applications
- Okta Multiple Users Failing To Authenticate From Ip
- Okta New API Token Created
- Okta New Device Enrolled on Account
- Okta Non-Standard VPN Usage
- Okta Phishing Detection with FastPass Origin Check
- Okta Risk Threshold Exceeded
- Okta Successful Single Factor Authentication
- Okta Suspicious Activity Reported
- Okta Suspicious Use of a Session Cookie
- Okta ThreatInsight Threat Detected
- Okta Unauthorized Access to Application
- Okta User Logins from Multiple Cities
Sigma 23
- New Okta User Created by Nasreddine Bencherchali (Nextron Systems)
- Okta 2023 Breach Indicator Of Compromise by Muhammad Faisal (@faisalusuf)
- Okta API Token Created by Austin Songer @austinsonger
- Okta API Token Revoked by Austin Songer @austinsonger
- Okta Admin Functions Access Through Proxy by Muhammad Faisal @faisalusuf
- Okta Admin Role Assigned to an User or Group by Austin Songer @austinsonger
- Okta Admin Role Assignment Created by Nikita Khalimonenkov
- Okta Application Modified or Deleted by Austin Songer @austinsonger
- Okta Application Sign-On Policy Modified or Deleted by Austin Songer @austinsonger
- Okta FastPass Phishing Detection by Austin Songer @austinsonger
- Okta Identity Provider Created by kelnage
- Okta MFA Reset or Deactivated by Austin Songer @austinsonger
- Okta Network Zone Deactivated or Deleted by Austin Songer @austinsonger
- Okta New Admin Console Behaviours by kelnage
- Okta Password Health Report Query by Muhammad Faisal (@faisalusuf)
- Okta Policy Modified or Deleted by Austin Songer @austinsonger
- Okta Policy Rule Modified or Deleted by Austin Songer @austinsonger
- Okta Security Threat Detected by Austin Songer @austinsonger
- Okta Suspicious Activity Reported by End-user by kelnage
- Okta Unauthorized Access to App by Austin Songer @austinsonger
- Okta User Account Locked Out by Austin Songer @austinsonger
- Okta User Session Start Via An Anonymising Proxy Service by kelnage
- Potential Okta Password in AlternateID Field by kelnage
Elastic 61
- Administrator Privileges Assigned to an Okta Group
- Attempt to Create Okta API Token
- Attempt to Deactivate an Okta Application
- Attempt to Deactivate an Okta Network Zone
- Attempt to Deactivate an Okta Policy
- Attempt to Deactivate an Okta Policy Rule
- Attempt to Delete an Okta Application
- Attempt to Delete an Okta Network Zone
- Attempt to Delete an Okta Policy
- Attempt to Delete an Okta Policy Rule
- Attempt to Modify an Okta Application
- Attempt to Modify an Okta Network Zone
- Attempt to Modify an Okta Policy
- Attempt to Modify an Okta Policy Rule
- Attempt to Reset MFA Factors for an Okta User Account
- Attempt to Revoke Okta API Token
- Attempted Bypass of Okta MFA
- Attempts to Brute Force an Okta User Account
- First Occurrence of Okta User Session Started via Proxy
- High Number of Okta User Password Reset or Unlock Attempts
- MFA Deactivation with no Re-Activation for Okta User Account
- Modification or Removal of an Okta Application Sign-On Policy
- Multiple Device Token Hashes for Single Okta Session
- Multiple Okta Sessions Detected for a Single User
- Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
- Multiple Okta User Authentication Events with Same Device Token Hash
- New Okta Authentication Behavior Detected
- New Okta Identity Provider (IdP) Added by Admin
- Okta Admin Console Login Failure
- Okta AiTM Session Cookie Replay
- Okta Alerts Following Unusual Proxy Authentication
- Okta FastPass Phishing Detection
- Okta Multiple OS Names Detected for a Single DT Hash
- Okta Sign-In Events via Third-Party IdP
- Okta Successful Login After Credential Attack
- Okta ThreatInsight Threat Suspected Promotion
- Okta User Assigned Administrator Role
- Okta User Session Impersonation
- Okta User Sessions Started from Different Geolocations
- Possible Okta DoS Attack
- Potential Okta Brute Force (Device Token Rotation)
- Potential Okta Brute Force (Multi-Source)
- Potential Okta Credential Stuffing (Single Source)
- Potential Okta MFA Bombing via Push Notifications
- Potential Okta Password Spray (Multi-Source)
- Potential Okta Password Spray (Single Source)
- Potentially Successful Okta MFA Bombing via Push Notifications
- Spike in Group Application Assignment Change Events
- Spike in Group Lifecycle Change Events
- Spike in Group Membership Events
- Spike in Group Privilege Change Events
- Spike in User Lifecycle Management Change Events
- Stolen Credentials Used to Login to Okta Account After MFA Reset
- Successful Application SSO from Rare Unknown Client Device
- Suspicious Activity Reported by Okta User
- Unauthorized Access to an Okta Application
- Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials
- Unusual Host Name for Okta Privileged Operations Detected
- Unusual Region Name for Okta Privileged Operations Detected
- Unusual Source IP for Okta Privileged Operations Detected
- Unusual Spike in Concurrent Active Sessions by a User
Microsoft Sentinel 9
- Device Registration from Malicious IP
- Failed Logins from Unknown or Invalid User
- High-Risk Admin Activity
- MFA Fatigue (OKTA)
- New Device/Location sign-in along with critical operation
- Okta Fast Pass phishing Detection
- Potential Password Spray Attack
- User Login from Different Countries within 3 hours
- User Session Impersonation(Okta)
Events
Minimum (1)
Recommended (10)
Listed (28)
- app.oauth2.as.token.grant
- application.integration.rate_limit_exceeded
- application.policy.sign_on.rule.delete
- application.policy.sign_on.update
- core.concurrency.org.limit.violation
- group.privilege.grant
- network_zone.rule.disabled
- policy.evaluate_sign_on
- system.email.account_unlock.sent_message
- system.email.password_reset.sent_message
- system.idp.lifecycle.create
- system.org.rate_limit.violation
- system.org.rate_limit.warning
- system.push.send_factor_verify_push
- system.sms.send_account_unlock_message
- system.sms.send_password_reset_message
- system.voice.send_account_unlock_call
- system.voice.send_password_reset_call
- user.account.privilege.grant
- user.account.unlock_token
- user.authentication.auth_via_IDP
- user.authentication.auth_via_inbound_SAML
- user.authentication.auth_via_social
- user.authentication.verify
- user.mfa.okta_verify.deny_push
- user.session.impersonation.initiate
- zone.remove_blacklist
- zone.update