OktaASA

Okta Advanced Server Access integration for Cortex XSIAM allows you to fetch logs of a wide range of configuration, enrollment, authentication, and authorization events that occur within the product and on your servers.

Analytics & SIEM · Okta ASA

Details

IDOktaASA
ProviderOkta
CategoryAnalytics & SIEM
From Version8.3.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesXSIAM

README

Okta Advanced Server Access integration for Cortex XSIAM allows you to fetch logs of a wide range of configuration, enrollment, authentication, and authorization events that occur within the product and on your servers.

Configure Okta ASA in Cortex

Parameter Description Required
Server URL (e.g. https://app.scaleft.com)   True
API Key ID The API Key ID to use for connection. True
API Key Secret The API Key Secret to use for connection. True
Team Name A named group of users who can authenticate with Okta. True
The maximum number of audit events per fetch.   False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

okta-asa-get-events

Gets events from Okta ASA.

Base Command

okta-asa-get-events

Input

Argument Name Description Required
should_push_events If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false. Required
limit Maximum results to return. Default is 50. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (e.g., https://app.scaleft.com) (required)
  • credentials — API Key ID (required)
  • team_name — Team Name (required)
  • max_audit_events_per_fetch — The maximum number of audit events per fetch.
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • okta-asa-get-events

    Gets events from Okta ASA.

Source

OktaASA.py OktaASA_test.py OktaASA.yml OktaASA_description.md command_examples.txt
Download History Raw 

## Create a service user and an API key

1. From the Advanced Server Access dashboard, click **Users**.
2. Select the **Service Users** tab.
3. Click **Create Service User**. The Create Service User page appears.
4. Enter a username for the service user. The system automatically creates corresponding Linux and Windows usernames. 
5. Click **Create Service User** to finish creating the service user.
6. Click **Create API Key**. The API Key Secret Rotated page appears.
7. Copy and store your API key ID and your API key secret from this page.

Note: You cannot retrieve this information after closing the window. If you lose this information, you must generate a new API ID and key.