What it collects
The connector polls the Okta System Log API and stores every event: sign-in success and failure, MFA challenges, session events, user and group changes, application assignments and administrator actions. Events arrive with observer.vendor: okta and event.dataset: okta.systemlog, the acting user in user.name, the target in user.target.name where applicable, and the client address in source.ip.
Prerequisites
- An Okta API token with permission to read the System Log.
- Outbound HTTPS from the deployment to your Okta domain.
Configure
Settings › Integrations › Add integration › Okta. Enter the Okta base URL and an API token, choose the organization the events belong to, and save. Collection starts from a few minutes before the first poll; earlier history is not imported.
Health
Settings › Integrations shows the connector's events in the last hour, its last event, and its last poll or the error that stopped it.
Response
With a credential that also has user management rights, playbooks can disable an Okta user and revoke their sessions. Configure that permission only if you intend to use it; see Response actions.