A user modified an Okta network zone

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires: Okta Audit Log
Detection Modules	Identity Threat Module
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses (T1562) Impair Defenses: Disable or Modify Cloud Firewall (T1562.007)
Severity	Informational

An Okta network zone was modified by a user.

An attacker may attempt to modify an Okta network zone to weaken an organization's security controls.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Investigate if any other network zones have been changed or removed.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

An atypical modification to the Okta Network zone has been performed by the user.

An attacker may attempt to modify an Okta network zone to weaken an organization's security controls.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Investigate if any other network zones have been changed or removed.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An Okta network zone was modified by a user with suspicious characteristics.

An attacker may attempt to modify an Okta network zone to weaken an organization's security controls.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Investigate if any other network zones have been changed or removed.