Okta New Admin Console Behaviors Detected
This rule detects when Okta identifies new or unusual activity within the Admin Console. It specifically looks for 'policy.evaluate_sign_on' events targeting the 'Okta Admin Console' where Okta's internal heuristics (debugcontext.debugdata.behaviors or debugcontext.debugdata.logonlysecuritydata) flag the activity as 'POSITIVE' for unusual behavior. This can indicate an adversary attempting to gain or maintain access to administrative functions, or an administrator performing actions that are outside their typical patterns.
Sigma
