OktaAuth0EventCollector

Details

ID	`OktaAuth0EventCollector`
Provider	Okta
Category	Analytics & SIEM
From Version	8.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Okta Auth0 logs event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 2.0 of Okta Auth0.
Please see the Okta Auth0 rate limit policy.

Configure Okta Auth0 Event Collector in Cortex

Parameter	Description	Required
Server URL		True
Client ID	The API key to use for connection.	True
Client Secret		True
First fetch (<number> <time unit>, e.g., 12 hours, 7 days)		False
The maximum number of events per fetch		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

okta-auth0-get-events

Manual command to fetch events and display them.

Base Command

okta-auth0-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return. Maximum is 2000. Default is 10.	Optional
since	Occurrence time of the least recent event to include (inclusive). Default is 3 days.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Client ID (required)
since — First fetch (<number> <time unit>, e.g., 12 hours, 7 days)
limit — The maximum number of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

okta-auth0-get-events
Manual command to fetch events and display them.

Source

OktaAuth0EventCollector.py OktaAuth0EventCollector_test.py OktaAuth0EventCollector.yml OktaAuth0EventCollector_description.md

Download History Raw

To begin fetching events from Okta Auth0 API you need to have a machine to machine (M2M) application in your Auth0 UI. In the M2M application you can find your client ID and secret to configure the instance.

### Create an Okta Auth0 API M2M application
1. Access OneLogin as an account owner or administrator.
2. In the side bar go to **Applications** > **Applications**.
3. Click **Create Application**, choose **Machine to Machine Applications** and click **Create**.
4. Select the authorized API URL you want to use in the instance.
5. To fetch the logs, choose the permission `read:logs`.
6. Click **Authorize**.
7. In the created application under the **Quick Start** tab locate the client credentials to use to configure the integration instance.

**Note**: To fetch the Auth0 logs you need to set the permission `read:logs` in the M2M application.

For more information about how to register M2M apps, see the [Auth0 documentation](https://auth0.com/docs/get-started/auth0-overview/create-applications/machine-to-machine-apps).


### Log Data Retention
Important: Your Auth0 log retention period depends on your subscription level.

| Plan | Log Retention |
| --- | --- |
| Starter | 1 day|
| B2C Essentials | 2 days |
| B2C Professional | 10 days |
| B2B Essentials | 10 days |
| B2B Professional | 10 days |
| Enterprise | 30 days |

**Note from Auth0**: Auth0 does not provide real-time logs for your tenant. While we do our best to index events as they arrive, you may see some delays.

For more information see [this](https://auth0.com/docs/deploy-monitor/logs/log-data-retention)