Product
low
advisory
Okta Policy Modification or Deletion Detected
2 rules 1 TTPAn Okta policy was modified or deleted, potentially indicating unauthorized changes to security configurations within the Okta identity management platform by a malicious actor or insider.
Okta Identity Cloud
identity
okta
policy
attack.impact
2r
1t
medium
advisory
Okta MFA Reset or Deactivation Attempt
2 rules 1 TTPAn attacker attempts to disable or reset multi-factor authentication (MFA) for a user account in Okta, potentially leading to unauthorized access and account compromise.
Okta Identity Cloud
okta
mfa
credential-access
persistence
2r
1t
medium
advisory
Okta API Token Creation
2 rules 1 TTPDetection of Okta API token creation events which can indicate malicious persistence activity.
Okta Identity Cloud
persistence
okta
2r
1t