Okta Identity Provider Created

Title: Okta Identity Provider Created
Status: test
Description:Detects when a new identity provider is created for Okta.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Author: kelnage
Date: 2023-09-07
modified:2026-04-27
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098.001'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    eventType: 'system.idp.lifecycle.create'
  condition:selection
Falsepositives:
  -When an admin creates a new, authorised identity provider.
Level: medium