Threat hunting rules are published for OKTA support compromise-related IOCs.

Rules:
1- rules-threat-hunting/cloud/okta/okta_password_health_report_query.yml 2- rules-emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml