Attempt to Modify an Okta Network Zone

edit

Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization’s security controls.

Rule type: query

Rule indices:

  • filebeat-*
  • logs-okta*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Identity
  • Okta
  • Continuous Monitoring
  • SecOps
  • Network Security
  • Defense Evasion

Version: 100 (version history)

Added (Elastic Stack release): 7.9.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Consider adding exceptions to this rule to filter false positives if Oyour organization’s Okta network zones are regularly modified.

Investigation guide

edit

Rule query

edit
event.dataset:okta.system and event.action:(zone.update or
network_zone.rule.disabled or zone.remove_blacklist)

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 100 (8.5.0 release)
  • Formatting only
Version 8 (8.4.0 release)
  • Formatting only
Version 6 (7.13.0 release)
  • Formatting only
Version 5 (7.12.0 release)
  • Formatting only
Version 4 (7.11.2 release)
  • Formatting only
Version 3 (7.11.0 release)
  • Rule name changed from: Attempt to Modify Okta Network Zone
  • Updated query, changed from:

    event.dataset:okta.system and event.action:(zone.update or
    zone.deactivate or zone.delete or network_zone.rule.disabled or
    zone.remove_blacklist)
Version 2 (7.10.0 release)
  • Updated query, changed from:

    event.module:okta and event.dataset:okta.system and
    event.action:(zone.update or zone.deactivate or zone.delete or
    network_zone.rule.disabled or zone.remove_blacklist)