Okta Content Pack

The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.

Okta is a cloud-based identity management service that provides access to a wide range of applications like Amazon, Google, Box, Office 365, and others. This technology pack will process Okta logs, providing normalization and enrichment of common events of interest.

Requirements

• A configured Okta Developer, Preview, or Custom Domain Organization

• A user account in the Okta Organization with 'Report Administrator' and 'Organization Administrator' or higher permissions

• An Okta API token for data collection (see Okta documentation for token creation)

Supported Versions

• Okta API version 2021.04.1 and later

Log Collection and Delivery

Okta logs are collected via the Okta System Log API. An API token must be created in the Okta Admin console and configured in a Graylog Okta input. Okta API tokens have the same permissions as the user who creates them. Consider creating a dedicated service account to limit access.

Create Okta API Token

To create the API token:

1. Log in to the Okta Admin console with 'Report Administrator' and 'Organization Administrator' permissions.

2. Navigate to Security > API > Tokens (Classic UI) or API > Tokens (Developer Console).

3. Click 'Create Token', name it, and record the token value immediately.

4. Optional: Remove 'Organization Administrator' role from the service account to limit to read-only access.

Stream Configuration

This technology pack includes 1 stream:

• "Illuminate:Okta Messages"

Hint: If this stream does not exist prior to the activation of this pack then it will be created and configured to route messages to this stream and the associated index set. There should not be any stream rules configured for this stream.

Index Set Configuration

This technology pack includes 1 index set definition:

• "Okta System Logs"

Hint: If this index set is already defined, then nothing will be changed. If this index set does not exist, then it will be created with retention settings of a daily rotation and 90 days of retention. These settings can be adjusted as required after installation.

What is Provided

• Parsing rules to extract Okta logs into Graylog schema compatible fields

• GIM event type categorization and enforcement fields for supported Okta events

Log Format Example

{"actor":{"id":"00uznmiqsr1UIPqr90h9","type":"User","alternateId":"test.user@graylog.com","displayName":"Test User","detailEntry":null},"client":{"userAgent":{"rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36","os":"Windows 10","browser":"CHROME"},"zone":"null","device":"Computer","id":null,"ipAddress":"10.10.84.54","geographicalContext":{"city":"Dallas","state":"Mississippi","country":"United States","postalCode":"90210","geolocation":{"lat":40.969,"lon":-106.6034}}},"device":null,"authenticationContext":{"authenticationProvider":null,"credentialProvider":null,"credentialType":null,"issuer":null,"interface":null,"authenticationStep":0,"externalSessionId":"00uznmiqsr1UIPqr90h9"},"displayMessage":"User login to Okta","eventType":"user.session.start","outcome":{"result":"SUCCESS","reason":null},"published":"2021-10-18T20:49:24.126Z","securityContext":{"asNumber":null,"asOrg":null,"isp":null,"domain":null,"isProxy":null},"severity":"INFO","debugContext":{"debugData":{"requestId":"YW3d0-2p3-1iwOeHylXaAVXRCcE","origin":"https://test.graylog.net","requestUri":"/api/v0/authx","threatSuspected":"false","url":"/api/v0/authx?"}},"legacyEventType":"core.user_auth.login_success","transaction":{"type":"WEB","id":"YW3d0-2p3-1iwOeHylXaAVXRCcE","detail":{}},"uuid":"e05d81bb-3054-837b-11ec-9bf29b682db0","version":"0","request":{"ipChain":[{"ip":"10.10.84.54","geographicalContext":{"city":"Lakeside","state":"Omaha","country":"United States","postalCode":"90210","geolocation":{"lat":33.696,"lon":-104.0346}},"version":"V4","source":null}]},"target":null}

GIM Categorization

GIM categorization is provided for the following event types:

Fields Extracted by This Pack

Parsed Fields

These are the fields extracted and mapped by the Okta content pack.