Ctrlk
Knowledge BaseRelease NotesRequest Demo
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Okta Logs

Panther supports pulling logs directly from Okta

Overview

Panther has the ability to fetch Okta events by querying the Okta System Log API. Panther will query the System Log API every 1 minute. In order for Panther to access the API you need to create a new API token or use an existing one.

You can also enable Okta user and device profiles.

Identity Threat Protection (ITP) Support: Panther's Okta.SystemLog schema includes fields for Okta Identity Engine with Identity Threat Protection enabled. These fields capture enrichment data including bot protection, IP reputation, risk scoring, and user behavior analysis that enhance security visibility when ITP features are active in your Okta environment.

How to onboard Okta logs to Panther

Step 1: Create a new Okta API token

To create an Okta API token with permissions to query System Logs, you must be logged in as one of the following types of Okta administrator: a super administrator, organization administrator, or read-only administrator.

We recommend using a read-only administrator role, for least privilege.

See Okta's documentation for more information on managing administrator roles.

  1. Log in as Okta administrator.

  2. In the Okta Admin Console, navigate to Security > API.

  3. Navigate to the Tokens tab.

  4. Click Create token.

  5. Enter a descriptive name for your token, e.g., Panther API token.

  6. Copy the Token value and store it in a secure location. You will need it in the next steps.

    • Note: Okta will not display this value again.

Step 2: Create a new Okta source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Log Sources.

  2. Click Create New.

  3. Search for “Okta,” then click its tile.

  4. On the slide-out panel, click Start Setup.

  5. On the Configuration page, fill in the following fields:

    • Name: Enter a descriptive name for the source, e.g. My Okta logs.

    • Okta subdomain: Enter the subdomain of your Okta organization domain. You can refer to Okta documentation to find out more about your Okta org domain.

    • Okta domain: Select the appropriate domain name from the Okta domain drop-down.

    • API Token: Enter the token value you generated in the previous step.

  6. Click Setup.

  7. On the Enrichment page, if you would like to enable Okta Identity Profiles, to the right of User Profiles and/or Device Profiles, click the toggle ON.

    On the Enrichment settings page of the Create Okta source flow, there are toggles for User Profiles and Device Profiles. Next to each of the toggles is a Refresh period (min) field.

  8. Click Setup. You will be directed to a success screen:\

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Step 1: Set up Okta Log Streaming

This onboarding method does not support Enrichments.

To setup Okta Log Streaming you must be logged in as a super administrator.

See Okta's documentation for more information on managing administrator roles. You will also need access to the AWS console of your Panther account.

  1. Log in as ab Okta super administrator.

  2. In the Okta Admin Console, navigate to Reports > Log Streaming.

  3. Click Add New.

  4. Click AWS EventBridge.

  5. Enter a descriptive name for your source, e.g., Panther API token, a descriptive name of the Bus, the AWS region and the AWS account-id of your Panther instance.

    • You can find your region in the Main Info & Preferences section of the Settings page in the Panther Console.

  6. Click Save. You will find said EventBridge association in your AWS account.

Step 2: Create a new Okta source in Panther

  1. Log into your AWS account, and navigate to Amazon Eventbridge.

  2. Navigate to Integration > Parter event sources.

  3. Click on the newly created event source and click Associate with EventBus.

  4. Keep note of the name of the associated EventBridge bus as displayed in the console.

  5. In Panther Console, navigate to the left-hand navigation bar and click Log Sources.

  6. Click Create New.

  7. Search for “Okta Streaming” then click its tile.

  8. Click Start Setup.

  9. On the Configuration page, fill in the following fields:

    • Name: Enter a descriptive name for the source, e.g. My Okta logs.

    • Bus Name: Enter the EventBridge Bus ARN you associated in the steps above.

      • If you don't have easy access to your AWS account console you can try this name and the association will happen automatically

  10. Click Setup.

Panther-managed detections

See Panther-managed rules for Okta in the panther-analysis GitHub repository. These include:

Custom detections

Suspicious behavior reported example

A user has reported suspicious behavior from their account:

Custom detection patterns

Below are some common functions and example deep_get() uses when writing custom detections for Okta logs. Find more information on the various event types in the Okta documentation.

Supported log types

Okta.SystemLog

The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems.

Reference: Okta Documentation on System Log APIs.

PreviousNotion Logs
NextOneLogin Logs

Last updated

Was this helpful?