Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-okta

Okta

You can integrate Okta with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Okta product overview

Okta's Identity and Access Management (IAM) tool is a cloud-based service that simplifies and secures user access to applications, systems, and data. It works by providing a centralized platform for managing user identities, authentication, authorization, and single sign-on (SSO) across various applications and systems.

What we ingest

Sophos XDR collects Okta events over HTTPS by polling the Okta System Log API at your Okta org URL, using the API token from the integration. The collector requests events for each time range and follows Okta's link-based pagination until that range is finished. We use the following HTTP request methods:

  • GET on /api/v1/logs: Pulls Okta System Log events for your tenant for each time range with limit-based paging and a filter that scopes the request to Okta security event types.
  • GET on the rel="next" link from Okta's response link header: Follows Okta's HATEOAS pagination to retrieve subsequent pages until the current time range is complete.

Authentication uses the SSWS API token header (Authorization: SSWS) for every request. Okta returns system log entries as JSON, with one event per array element, and we ingest each entry as it's delivered. The event types that appear depend on which Okta features are licensed and turned on (for example, ThreatInsight, Network Zones, Shared Signals / SSF, or breached-credential detection).

Event and data types

We ingest the following event and data types from Okta. All records arrive as Okta System Log JSON and carry the original Okta envelope (uuid, eventType, published timestamp, client and useragent context, actor, target, debugContext, and outcome). What appears depends on which Okta security features your organization has turned on.

  • Attack detection: Okta-detected attack lifecycle events (security.attack.start, security.attack.end). Includes the affected actor/target and threat context. Normalized to third-party security alert telemetry.
  • Threat detection: Threat findings and threat configuration changes (security.threat.detected, security.threat.configuration.update). Normalized to third-party security alert telemetry.
  • Behavior detection: Okta behavior-detection signal configuration events (security.behavior.settings.create/update/delete). Normalized to third-party security alert telemetry.
  • Breached credentials: Detection of compromised/leaked credentials (security.breached_credential.detected). Normalized to third-party security alert telemetry.
  • Attack protection configuration: Changes to Okta attack-protection settings (security.attack_protection.settings.update). Normalized to authentication telemetry.
  • Authenticator lifecycle: Activation, creation, deactivation, and update of Okta authenticators or factors (security.authenticator.lifecycle.*). Normalized to authentication telemetry.
  • Network zones: Network zone block list additions and removals (security.zone.make_blacklist, security.zone.remove_blacklist). Normalized to authentication telemetry.
  • Voice country block list: Country-level voice block list additions and removals (security.voice.add_country_blacklist, security.voice.remove_country_blacklist). Normalized to authentication telemetry.
  • Device block list policy: Device block list policy additions, removals, and temporary disables (security.device.add_request_blacklist_policy, security.device.remove_request_blacklist_policy, security.device.temporarily_disable_blacklisting). Normalized to authentication telemetry.
  • Trusted origins: Trusted origin activation, creation, deactivation, update, and deletion (security.trusted_origin.*). Normalized to authentication telemetry.
  • Blocked requests: Requests Okta blocked for policy reasons (security.request.blocked). Normalized to authentication telemetry.
  • Session protection: Client roaming detection on Okta sessions (security.session.detect_client_roaming). Normalized to authentication telemetry.
  • Shared Signals Framework (SSF): Provider and transmitter activity for Okta's Shared Signals integrations (security.events.provider., security.events.transmitter.). Normalized to authentication telemetry.

Data provided by this integration

Data provided by Okta gets normalized to the following schemas:

  • auth
  • thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation