Detection Engineering.
assign an Okta admin role to a random user to see if your SIEM gets it….duh. The choices really are: Trigger the activity in production (if safe) Trigger the activity in a test environment that’s shipping logs to your SIEM for ingestion Inject logs collected after such activity into a SIEM intake