Okta Detections and Queries
Panther supports ingesting Okta System Logs. See Panther's Okta Logs documentation for instructions.
The Okta System Log schema can be found in the Panther Console under Configure > Schemas or from the Panther Analysis repository on Github.
Panther has several native detections for Okta. These can all be found within the Panther Analysis repository on Github.
- Geographically Improbable Okta Login - A user has subsequent logins from two geographic locations that are very far apart
Have other Okta detections that can be used by other customers? Consider sharing detections back to the Panther Analysis repository or work with your Customer Success team!
Description: A user has reported suspicious behavior from their account
def rule(event):
if event.get('eventtype') == 'user.account.report_suspicious_activity_by_enduser':
return True
Below are some common functions and example
deep_get() uses when writing custom detections for Okta. Explanations on different event types can be found in the Okta documentation.#Okta has many event types that are listed here. You can begin your detection based on one of these eventtypes
#https://developer.okta.com/docs/reference/api/event-types/
event.get('eventtype')
#To access the city, state, lat, lon etc.
deep_get(event, 'client', 'geographicalContext', 'city')
deep_get(event, 'client', 'geographicalContext', 'state')
deep_get(event, 'client', 'geographicalContext', 'country')
deep_get(event, 'client', 'geographicalContext', 'geolocation', 'lon')
deep_get(event, 'client', 'geographicalContext', 'geolocation', 'lat')
#Details on the source of the event
deep_get(event, 'client' 'device')
deep_get(event, 'client', 'ipAddress')
deep_get(event, 'client', 'userAgent')
deep_get(event, 'actor', 'alternateId')
deep_get(event, 'actor', 'displayName')
## Global helpers that may be useful with Okta
# within panther_base_helpers
def okta_alert_context(event: dict):
"""Returns common context for automation of Okta alerts"""
return {
"ips": event.get("p_any_ip_addresses", []),
"actor": event.get("actor", ""),
"target": event.get("target", ""),
"client": event.get("client", ""),
}
# within panther_base_helpers
def is_ip_in_network(ip_addr, networks):
"""Check that a given IP is within a list of IP ranges"""
return any(ip_address(ip_addr) in ip_network(network) for network in networks)
Below are a few queries to get started with investigating and learning about your Okta events. These queries are meant to investigate existing log data. If you are interested in detecting new data that flows in, we recommend trying out the detections shown above.
The following queries are written for Snowflake SQL syntax, unless noted otherwise.
-- Top logins by user last 7 days
SELECT actor:alternateId as actor, COUNT(*) as total
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.authentication.sso'
and outcome:result = 'SUCCESS'
and p_occurs_since(7d)
GROUP BY actor
ORDER BY total desc
-- Logins by hour last 1 day
SELECT
time_slice(p_event_time, 1, 'HOUR', 'START') as "start",
time_slice(p_event_time, 1, 'HOUR', 'END') as "end",
count(*) as "logins",
count(distinct(actor:alternateId)) as "users"
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.authentication.sso'
and outcome:result = 'SUCCESS'
and p_occurs_since(1d)
GROUP BY "start", "end"
ORDER BY "start" desc
-- Top applications last 7 days
SELECT GET(target, 0):displayName as application, count(*) as total
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.authentication.sso'
and p_occurs_since(7d)
GROUP BY Application
ORDER BY total desc
-- Top failing users last 7 days
SELECT actor:alternateId as actor, COUNT(*) as total
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.session.start'
and outcome:result = 'FAILURE'
and outcome:reason = 'INVALID_CREDENTIALS'
and p_occurs_since(7d)
GROUP BY actor
ORDER BY total desc
-- Login failures by reason
SELECT outcome:reason as reason, COUNT(*) as total
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.session.start'
and outcome:result = 'FAILURE'
and p_occurs_since(7d)
GROUP BY reason
ORDER BY total desc
-- Fake account login attempts
SELECT actor:alternateId as actor, COUNT(*) as total
FROM panther_logs.public.okta_systemlog
WHERE eventtype = 'user.session.start' and
outcome:result = 'FAILURE' and
outcome:reason = 'VERIFICATION_ERROR'
GROUP BY actor
ORDER BY total desc
Identify Okta Support access to your Okta organization
Snowflake SQL:
SELECT
p_event_time as event_time,
actor:alternateId as actor_email,
actor:displayName as actor_name,
client:ipAddress as src_ip,
client:geographicalContext:city as city,
client:geographicalContext:country as country,
client:userAgent:rawUserAgent as user_agent,
displayMessage,
eventType
FROM
panther_logs.public.okta_systemlog
WHERE
eventType = 'user.session.impersonation.grant'
OR
eventType = 'user.session.impersonation.initiate'
AND
p_occurs_between('YYYY-MM-DD','YYYY-MM-DD')
ORDER BY
event_time desc
Athena SQL:
SELECT
p_event_time as event_time,
actor.alternateid as actor_email,
actor.displayName as actor_name,
displayMessage,
eventType,
client.ipAddress as src_ip,
client.geographicalContext.city as city,
client.geographicalContext.country as country,
client.useragent.rawUserAgent as user_agent
FROM panther_logs.okta_systemlog
WHERE
(
eventType = 'user.session.impersonation.grant' OR
eventType = 'user.session.impersonation.initiate'
) and
p_occurs_between('YYYY-MM-DD','YYYY-MM-DD')
ORDER BY
event_time desc
Identify all users who have been granted Admin privileges in Okta
Snowflake SQL:
SELECT
p_event_time as event_time,
actor:alternateId as actor_email,
actor:displayName as actor_name,
displayMessage,
eventType,
debugContext:debugData:privilegeGranted as priv_granted,
target as target_user,
client:ipAddress as src_ip,
client:geographicalContext:city as city,
client:geographicalContext:country as country,
client:userAgent:rawUserAgent as user_agent
FROM
panther_logs.public.okta_systemlog
WHERE
( eventType = 'user.account.privilege.grant'
OR
eventType = 'group.privilege.grant'
AND
debugContext:debugData:privilegeGranted like '%Admin%'
)
AND
p_occurs_between(''YYYY-MM-DD','YYYY-MM-DD')
ORDER BY
event_time desc
Athena SQL:
SELECT
p_event_time as event_time,
actor.alternateid as actor_email,
actor.displayName as actor_name,
displayMessage,
eventType,
client.ipAddress as src_ip,
client.geographicalContext.city as city,
client.geographicalContext.country as country,
client.useragent.rawUserAgent as user_agent
FROM panther_logs.okta_systemlog
WHERE
(
eventType = 'user.account.privilege.grant' OR
eventType = 'group.privilege.grant'
) AND
p_occurs_between('YYYY-MM-DD','YYYY-MM-DD')
ORDER BY
event_time desc
Last modified 2mo ago