IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Attempt to Delete an Okta Policy Attempt to Disable Auditd Service »
Elastic Docs ›Elastic Security Solution [8.16] ›Detections and alerts ›Prebuilt rule reference

Attempt to Delete an Okta Policy Rule

edit

Attempt to Delete an Okta Policy Rule

edit

Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization’s security controls.

Rule type: query

Rule indices:

  • filebeat-*
  • logs-okta*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: None (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Use Case: Identity and Access Audit
  • Data Source: Okta
  • Tactic: Defense Evasion

Version: 410

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Attempt to Delete an Okta Policy Rule

Okta policy rules are integral components of an organization’s security controls, as they define how user access to resources is managed. Deletion of a rule within an Okta policy could potentially weaken the organization’s security posture, allowing for unauthorized access or facilitating other malicious activities.

This rule detects attempts to delete an Okta policy rule, which could indicate an adversary’s attempt to weaken an organization’s security controls. Adversaries may do this to circumvent security measures and enable further malicious activities.

Possible investigation steps:

  • Identify the actor related to the alert by reviewing okta.actor.id, okta.actor.type, okta.actor.alternate_id, or okta.actor.display_name fields in the alert.
  • Review the okta.client.user_agent.raw_user_agent field to understand the device and software used by the actor.
  • Examine the okta.outcome.reason field for additional context around the deletion attempt.
  • Check the okta.outcome.result field to confirm the policy rule deletion attempt.
  • Check if there are multiple policy rule deletion attempts from the same actor or IP address (okta.client.ip).
  • Check for successful logins immediately following the policy rule deletion attempt.
  • Verify whether the actor’s activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.

False positive analysis:

  • Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.
  • Check the geographical location (okta.request.ip_chain.geographical_context) and time of the deletion attempt. If these match the actor’s normal behavior, it might be a false positive.
  • Verify the actor’s administrative rights to ensure they are correctly configured.

Response and remediation:

  • If unauthorized policy rule deletion is confirmed, initiate the incident response process.
  • Immediately lock the affected actor account and require a password change.
  • Consider resetting MFA tokens for the actor and require re-enrollment.
  • Check if the compromised account was used to access or alter any sensitive data or systems.
  • If a specific deletion technique was used, ensure your systems are patched or configured to prevent such techniques.
  • Assess the criticality of affected services and servers.
  • Work with your IT team to minimize the impact on users and maintain business continuity.
  • If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
  • Implement security best practices outlined by Okta.
  • Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

Setup

edit

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule query

edit
event.dataset:okta.system and event.action:policy.rule.delete

Framework: MITRE ATT&CKTM

« Attempt to Delete an Okta Policy Attempt to Disable Auditd Service »