Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Attempt to Revoke Okta API Token

Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations.

ATT&CK coverage

Outside the enterprise matrix

T1531

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

If the behavior of revoking Okta API tokens is expected, consider adding exceptions to this rule to filter false positives.

References

https://developer.okta.com/docs/reference/api/event-types/
https://developer.okta.com/docs/reference/api/system-log/
https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy

Tagged by the source as

Data Source: OktaResources: Investigation GuideTactic: ImpactUse Case: Identity and Access Audit

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.