Attempt to Modify Okta Network Zone
editAttempt to Modify Okta Network Zone
editOkta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization’s security controls.
Rule type: query
Rule indices:
- filebeat-*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Okta
- SecOps
- Network
- Continuous Monitoring
Version: 1
Added (Elastic Stack release): 7.9.0
Rule authors: Elastic
Rule license: Elastic License
Potential false positives
editConsider adding exceptions to this rule to filter false positives if your organization’s Okta network zones are regularly modified.
Investigation guide
editThe Okta Filebeat module must be enabled to use this rule.
Rule query
editevent.module:okta and event.dataset:okta.system and event.action:(zone.update or zone.deactivate or zone.delete or network_zone.rule.disabled or zone.remove_blacklist)