Okta Event Collector

Details

ID	`Okta Event Collector`
Provider	Okta
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/fastapi:0.125.0.10158186`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Collects the events log for authentication and Audit provided by Okta admin API

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure Okta Log in Cortex

Parameter	Description	Required
Server URL	Okta URL (https://yourdomain.okta.com)	True
Number of incidents to fetch per fetch	The total number of incidents to retrieve in each fetch cycle	True
proxy	Use system proxy settings	False
API key	The request API key	True
First fetch time interval	The period (in days) to retrieve events from, if no time is saved in the system	True
Fetch events	Whether to fetch events from Okta	False
Events Fetch Interval	The interval (in minutes) between fetch cycles	False

Commands

You can execute these commands in a playbook.

okta-get-events

Manual command to fetch events and display them. Use for development and debugging only, as it may produce duplicate events or disrupt the fetch mechanism.

Base Command

okta-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required
start_time	The start time from which to retrieve events. Supports relative time (for example, “5 minutes ago”, “3 days ago”) or ISO 8601 (for example, “2026-01-01T10:00:00Z”). Default is 5 minutes ago.	Optional
end_time	The end time until which to retrieve events. Supports relative time (for example, “1 hour ago”) or ISO 8601 (for example, “2026-01-01T12:00:00Z”). Defaults to the present moment.	Optional
limit	The maximum number of events to retrieve. Defaults to the instance level limit.	Optional
from_date	Deprecated. Use the start_time argument instead.	Optional

Context Output

Path	Type	Description
Okta.Event.uuid	String	Unique identifier of the event.
Okta.Event.published	Date	Timestamp when the event was published.
Okta.Event.eventType	String	The type of the event.
Okta.Event.displayMessage	String	Human readable description of the event.
Okta.Event.severity	String	The severity of the event.

Configuration parameters

url — Server URL (required)
api_key — (required)
limit — Number of events to fetch per fetch (required)
after — First fetch from API time (required)
verify — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
eventFetchInterval — Events Fetch Interval

Commands (1)

okta-get-events
Manual command to fetch events and display them. Use for development and debugging only, as it may produce duplicate events or disrupt the fetch mechanism.

Source

OktaEventCollector.py OktaEventCollector_test.py OktaEventCollector.yml OktaEventCollector_description.md

Download History Raw

commonfields:
  id: Okta Event Collector
  version: -1
sectionorder:
- Connect
- Collect
name: Okta Event Collector
display: Okta Event Collector
category: Analytics & SIEM
provider: Okta
description: Collects the events log for authentication and Audit provided by Okta admin API.
configuration:
- display: Server URL
  name: url
  type: 0
  required: true
  section: Connect
  additionalinfo: The Okta API base domain, for example https://<domain>.com. Do not append /api/v1/logs; the integration adds it automatically.
- displaypassword: API key
  name: api_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Number of events to fetch per fetch
  name: limit
  type: 0
  defaultvalue: 10000
  required: true
  additionalinfo: 'The total number of events to retrieve in each fetch cycle. The integration paginates automatically; the Okta API returns at most 1000 records per request.'
  section: Collect
- display: First fetch from API time
  name: after
  type: 15
  defaultvalue: 1 day
  required: true
  options:
  - 1 minute
  - 1 hour
  - 1 day
  - 3 day
  - 5 day
  - 1 week
  - 1 month
  - 1 year
  section: Collect
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  defaultvalue: "true"
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  defaultvalue: 1
  section: Collect
  advanced: true
  required: false
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - defaultValue: '5 minutes ago'
      description: 'The start time from which to retrieve events. Supports relative time (for example, "5 minutes ago", "3 days ago") or ISO 8601 (for example, "2026-01-01T10:00:00Z").'
      name: start_time
      required: false
    - description: 'The end time until which to retrieve events. Supports relative time (for example, "1 hour ago") or ISO 8601 (for example, "2026-01-01T12:00:00Z"). Defaults to the present moment.'
      name: end_time
      required: false
    - description: The maximum number of events to retrieve. Defaults to the instance level limit.
      name: limit
      required: false
    - description: 'Deprecated. Use the start_time argument instead.'
      deprecated: true
      name: from_date
      required: false
    description: Manual command to fetch events and display them. Use for development and debugging only, as it may produce duplicate events or disrupt the fetch mechanism.
    name: okta-get-events
    outputs:
    - contextPath: Okta.Event.uuid
      description: Unique identifier of the event.
      type: String
    - contextPath: Okta.Event.published
      description: Timestamp when the event was published.
      type: Date
    - contextPath: Okta.Event.eventType
      description: The type of the event.
      type: String
    - contextPath: Okta.Event.displayMessage
      description: Human readable description of the event.
      type: String
    - contextPath: Okta.Event.severity
      description: The severity of the event.
      type: String
  dockerimage: demisto/fastapi:0.125.0.10158186
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
fromversion: 6.8.0
tests:
- No tests