| elastic |
Attempt to Deactivate an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
High Number of Okta User Password Reset or Unlock Attempts |
production |
2026-09-18 |
| elastic |
Attempt to Revoke Okta API Token |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Application |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Application |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Application |
production |
2026-09-18 |
| elastic |
Possible Okta DoS Attack |
production |
2026-09-18 |
| elastic |
First Occurrence of Okta User Session Started via Proxy |
production |
2026-09-18 |
| elastic |
Okta FastPass Phishing Detection |
production |
2026-09-18 |
| elastic |
Okta Alerts Following Unusual Proxy Authentication |
production |
2026-09-18 |
| elastic |
Unauthorized Access to an Okta Application |
production |
2026-09-18 |
| elastic |
Okta User Sessions Started from Different Geolocations |
production |
2026-09-18 |
| elastic |
Okta Sign-In Events via Third-Party IdP |
production |
2026-09-18 |
| elastic |
Successful Application SSO from Rare Unknown Client Device |
production |
2026-09-18 |
| elastic |
Suspicious Activity Reported by Okta User |
production |
2026-09-18 |
| elastic |
Multiple Okta Sessions Detected for a Single User |
production |
2026-09-18 |
| elastic |
Okta ThreatInsight Threat Suspected Promotion |
production |
2026-09-18 |
| elastic |
Administrator Privileges Assigned to an Okta Group |
production |
2026-09-18 |
| elastic |
Potential Remote Install via MsiExec |
production |
2026-09-18 |
| elastic |
MsiExec Service Child Process With Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-09-18 |
| elastic |
Mshta Making Network Connections |
production |
2026-09-18 |
| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
MS Office Macro Security Registry Modifications |
production |
2026-09-18 |
| elastic |
System File Ownership Change |
production |
2026-09-18 |
| elastic |
Okta User Assigned Administrator Role |
production |
2026-09-18 |
| elastic |
Attempt to Create Okta API Token |
production |
2026-09-18 |
| elastic |
Attempt to Reset MFA Factors for an Okta User Account |
production |
2026-09-18 |
| elastic |
MFA Deactivation with no Re-Activation for Okta User Account |
production |
2026-09-18 |
| elastic |
New Okta Identity Provider (IdP) Added by Admin |
production |
2026-09-18 |
| elastic |
Modification or Removal of an Okta Application Sign-On Policy |
production |
2026-09-18 |
| elastic |
Stolen Credentials Used to Login to Okta Account After MFA Reset |
production |
2026-09-18 |
| elastic |
Spike in Privileged Command Execution by a User |
production |
2026-09-18 |
| elastic |
High Command Line Entropy Detected for Privileged Commands |
production |
2026-09-18 |