OktaASA

Details

ID	`OktaASA`
Provider	Okta
Category	Analytics & SIEM
From Version	8.3.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Okta Advanced Server Access integration for Cortex XSIAM allows you to fetch logs of a wide range of configuration, enrollment, authentication, and authorization events that occur within the product and on your servers.

Configure Okta ASA in Cortex

Parameter	Description	Required
Server URL (e.g. https://app.scaleft.com)		True
API Key ID	The API Key ID to use for connection.	True
API Key Secret	The API Key Secret to use for connection.	True
Team Name	A named group of users who can authenticate with Okta.	True
The maximum number of audit events per fetch.		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

okta-asa-get-events

Gets events from Okta ASA.

Base Command

okta-asa-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum results to return. Default is 50.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., https://app.scaleft.com) (required)
credentials — API Key ID (required)
team_name — Team Name (required)
max_audit_events_per_fetch — The maximum number of audit events per fetch.
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

okta-asa-get-events
Gets events from Okta ASA.

Source

OktaASA.py OktaASA_test.py OktaASA.yml OktaASA_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Okta
sectionorder:
- Connect
- Collect
commonfields:
  id: OktaASA
  version: -1
configuration:
- defaultvalue: https://app.scaleft.com
  display: Server URL (e.g., https://app.scaleft.com)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key Secret
  display: API Key ID
  additionalinfo: The API Key ID to use for connection.
  name: credentials
  required: true
  section: Connect
  type: 9
- display: Team Name
  additionalinfo: A named group of users who can authenticate with Okta.
  name: team_name
  type: 0
  section: Connect
  required: true
- defaultvalue: 5000
  section: Collect
  display: The maximum number of audit events per fetch.
  name: max_audit_events_per_fetch
  required: false
  type: 0
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Okta Advanced Server Access integration for Cortex XSIAM allows you to fetch logs of a wide range of configuration, enrollment, authentication, and authorization events that occur within the product and on your servers.
display: Okta ASA
name: OktaASA
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command will create events, otherwise it will only display them.
      isArray: false
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - defaultValue: 50
      description: Maximum results to return.
      isArray: false
      name: limit
      required: false
      secret: false
    deprecated: false
    description: Gets events from Okta ASA.
    execution: false
    name: okta-asa-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.3.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam