Attempt to Modify Okta Network Zone
editAttempt to Modify Okta Network Zone
editOkta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization’s security controls.
Rule type: query
Rule indices:
- filebeat-*
- logs-okta*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Identity
- Okta
- Continuous Monitoring
- SecOps
- Network Security
Version: 2 (version history)
Added (Elastic Stack release): 7.9.0
Last modified (Elastic Stack release): 7.10.0
Rule authors: Elastic
Rule license: Elastic License
Potential false positives
editConsider adding exceptions to this rule to filter false positives if your organization’s Okta network zones are regularly modified.
Investigation guide
editThe Okta Filebeat module must be enabled to use this rule.
Rule query
editevent.dataset:okta.system and event.action:(zone.update or zone.deactivate or zone.delete or network_zone.rule.disabled or zone.remove_blacklist)
Rule version history
edit- Version 2 (7.10.0 release)
-
-
Updated query, changed from:
event.module:okta and event.dataset:okta.system and event.action:(zone.update or zone.deactivate or zone.delete or network_zone.rule.disabled or zone.remove_blacklist)
-