Okta overview

Okta is a cloud-based Identity and Access Management (IAM) platform designed to secure user authentication and manage access to applications, devices, and APIs. It offers key features like Single Sign-On (SSO), Multi-Factor Authentication (MFA), lifecycle management, and directory integration, helping organizations streamline access control.

Okta extension scope

Okta extension allows users to add their Okta domains to collect Okta system logs to Log360 cloud. This extension provides features such as log collection, parsing, reporting, alerting, correlation, and advanced log search capabilities for monitoring web traffic and server performance.

Audited Okta events

Okta provides detailed logs for all actions that modify the Okta domain. These logs capture key system events, including changes to user accounts, groups, and applications.

Major logged events

1. User lifecycle management
   • User creation, modification, and deletion
   • Activation, deactivation, suspension, and unsuspension of user accounts
2. Group management
   • Creation and deletion of groups
   • User assignments to and removals from groups
3. Application management
   • Creation, update, integration, and deletion of applications
   • Assignment and removal of users from applications

How to configure Okta log source in Log360 Cloud

1. Navigate to Settings > Marketplace > Installed Extensions to view the installed Okta extension.
2. Click Manage under configuration to open the Manage Configuration page.



3. To configure the Okta log source, click Configure to open the configuration page. Then, navigate to Settings > Configurations > Log Source Configuration > Applications > Other Applications.



4. In the Display Name field, enter a name for the Okta source in Log360 cloud
5. In the Organization URL field, enter the Okta domain (eg: exampledomain.okta.com )
Note: Please refer to this document to identify the Okta domain URL.
6. In the Auth token field, add the auth token associated with your Okta account. The auth token must be created by an admin who has access to view the system logs.
Note:
1. Read-only administrator role is enough to fetch and display all the relevant Okta data in Log360 Cloud.
2. Please refer to this document for the steps to create auth token in Okta

Viewing Okta reports

To view Okta reports, navigate to the Reports tab and select Okta for Log360 Cloud in the sub-tab.

Log360 Cloud provides the following out-of-the-box reports:

Okta correlation actions

To view the Okta correlation actions, navigate to the Correlation tab -> Manage Rules.

In the Manage Rules page, select Okta as the Rule Category to filter out the related correlation actions. You can select the actions and build custom rules.

Okta Alerts

To view the Alerts, navigate to the Alerts tab -> Manage Alert Profiles.

In the Manage Alert Profiles page, select Custom Alert Profiles as the Alert Profile Type. Click the search icon and add Okta to filter out the alert criteria.