Okta Network Zone

eventType	Description	Sample	Rule
network_zone.rule.disabled		N	Y

network_zone.rule.disabled

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`eventType`	1 detection rule	Kusto
`outcome.result`	1 detection rule	Kusto

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`okta::outcome.result` (kusto rule field)	eq	`SUCCESS`	1 rule	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Attempt to Modify an Okta Network Zone source medium: Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.T1484, T1562, T1562.007

Kusto #

New Device/Location sign-in along with critical operation source medium: This query identifies users seen login from a new geo location/country and a new device, then correlates that sign-in with successful risky operations such as policy changes, MFA changes, API token actions etc. This can be an indication of an attacker gaining access to a user's credentials and then performing critical operations, which typically requires admin privileges. By detecting such patterns, organizations can quickly respond to potential security incidents and mitigate risks associated with unauthorized access and privilege escalation.T1078, T1098, T1556

References #

Okta Event Types Catalog: network_zone.rule.disabled