Skip to content

[New Rule] Attempt to Modify or Delete Okta Application Sign On Policy #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
threat-punter merged 6 commits into from
Jul 2, 2020
Merged

[New Rule] Attempt to Modify or Delete Okta Application Sign On Policy #10

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4d23511
Add okta rule for policy modification/delete
threat-punter Jul 1, 2020
4902ed7
Update rule name
threat-punter Jul 1, 2020
f66df16
Update rules/okta/okta_attempt_to_modify_or_delete_application_sign_o…
threat-punter Jul 2, 2020
8b3852c
Add event.module value to query
threat-punter Jul 2, 2020
551d25c
Update okta_attempt_to_modify_or_delete_application_sign_on_policy.toml
threat-punter Jul 2, 2020
c342211
Update rules/okta/okta_attempt_to_modify_or_delete_application_sign_o…
threat-punter Jul 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions rules/okta/okta_attempt_to_modify_or_delete_application_sign_on_policy.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
[metadata]
creation_date = "2020/07/01"
ecs_version = ["1.5.0"]
maturity = "production"
updated_date = "2020/07/01"

[rule]
author = ["Elastic"]
description = """
An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an
organization's security controls.
"""
false_positives = [
"""
Consider adding exceptions to this rule to filter false positives if sign on policies for Okta applications are
regularly modified or deleted in your organization.
""",
]
index = ["filebeat-*"]
language = "kuery"
license = "Elastic License"
name = "Modification or Removal of an Okta Application Sign-On Policy"
references = [
"https://developer.okta.com/docs/reference/api/system-log/",
"https://developer.okta.com/docs/reference/api/event-types/",
]
risk_score = 47
rule_id = "cd16fb10-0261-46e8-9932-a0336278cdbe"
severity = "medium"
tags = ["Elastic", "Okta"]
type = "query"

query = '''
event.module:okta and event.dataset:okta.system and event.action:(application.policy.sign_on.update or application.policy.sign_on.rule.delete)
'''