Okta IAM

Integrate with Okta's Identity Access Management service to execute CRUD operations to employee lifecycle processes.

Authentication & Identity Management · Okta

Details

IDOkta IAM
ProviderOkta
CategoryAuthentication & Identity Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Note: This integration should be used along with our ILM premium pack. For further details, visit our ILM pack documentation.

Integrate with Okta’s Identity Access Management service to execute CRUD operations to employee lifecycle processes.
This integration was integrated and tested with version v1 of the Okta integration.
For more information, refer to the Identity Lifecycle Management article.

Configure Okta IAM in Cortex

Parameter Description Required
url Okta URL (https://<domain>.okta.com) True
apitoken API Token (see Detailed Instructions) True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
create-user-enabled Allow creating users False
update-user-enabled Allow updating users False
enable-user-enabled Allow enabling users False
disable-user-enabled Allow disabling users False
create-if-not-exists Automatically create user if not found in update command False
mapper-in Incoming Mapper True
mapper-out Outgoing Mapper True
max_fetch Fetch Limit (recommended less than 200) False
isFetch Fetch incidents False
incidentFetchInterval Incidents Fetch Interval False
incidentType Incident type False
auto_generate_query_filter Query only application events configured in the IAM Configuration False
fetch_query_filter Fetch Query Filter (Okta system log events) True
first_fetch First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) False
  • To allow the integration to access the mapper from within the code, as required by the ILM pack, both mappers have to be configured in their proper respective fields and not in the “Mapper (outgoing)” dropdown list selector.

Fetch incidents using an “IAM - Configuration” incident

When the “Query only application events configured in IAM Configuration” checkbox is selected, add or remove event types for the applications you configured in the IAM Configuration incident are retrieved. You must have at least one application configured in XSOAR to fetch incidents from Okta.

Fetch incidents using a manual query filter expression

Note: Cortex XSOAR recommends you use the Query only application events configured in IAM Configuration option to generate the fetch-incidents query filter. The following following method should be used primarily for debugging purposes.
Clear the “Query only application events configured in IAM Configuration” checkbox to use a custom fetch query filter expression. The expression must be in SCIM syntax, and include the add and remove event types, as well as the application ID.
For example: (eventType eq "application.user_membership.add" or eventType eq "application.user_membership.remove") and target.id eq "0oar418fvkm67MWGd0h7"
You may also use the advanced search in Okta’s System Logs to generate the filter expression.
For more details, visit Okta API reference.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user.

Base Command

iam-create-user

Input

Argument Name Description Required
user-profile User Profile indicator details. Required
allow-enable When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-create-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\", \"surname\":\"Test\",\"givenname\":\"Demisto\"}

Human Readable Output

Create User Results (Okta IAM)
brand instanceName success active id username email details
Okta IAM Okta IAM_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:54:30.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto44@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required
allow-enable When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-update-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\", \"givenname\":\"Demisto-Test\"}

Human Readable Output

Update User Results (Okta IAM)
brand instanceName success active id username email details
Okta IAM Okta IAM_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-get-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\"}

Human Readable Output

Get User Results (Okta IAM)
brand instanceName success active id username email details
Okta IAM Okta IAM_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-disable-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\"}

Human Readable Output

Disable User Results (Okta IAM)
brand instanceName success active id username email details
Okta IAM Okta IAM_instance_1 true false 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}}

okta-get-assigned-user-for-app

Gets a specific user assignment for an application by id.

Base Command

okta-get-app-user-assignment

Input

Argument Name Description Required
user_id ID of the user for which to get information. Required
application_id ID of the application for which to get information. Required

Context Output

Path Type Description
Okta.AppUserAssignment.UserID string ID of the user.
Okta.AppUserAssignment.AppID string ID of the application.
Okta.AppUserAssignment.IsAssigned boolean When True, indicates that the user is assigned to the application.
Okta.AppUserAssignment.ProfileInApp unknown The user profile data in the application.

Command Example

!okta-get-app-user-assignment user_id=00uuv6y8t1iy8YXm94h7 application_id=0oae3ioe51sQ64Aui2h7

Human Readable Output

App User Assignment
App ID Is Assigned User ID
0oae3ioe51sQ64Aui2h7 true 00uuv6y8t1iy8YXm94h7

okta-list-applications

Returns a list of Okta applications data.

Base Command

okta-iam-list-applications

Input

Argument Name Description Required
query Search for applications by their names. Optional
page Page number (0-based). Default is 0. Optional
limit Maximum number of apps to retrieve (maximal value is 200). Default is 50. Optional

Context Output

Path Type Description
Okta.Application.ID string ID of the application.
Okta.Application.Name string Name of the application.
Okta.Application.Label string Label of the application.
Okta.Application.Logo string Logo of the application.

Command Example

!okta-iam-list-applications limit=5 query="Workday"

Human Readable Output

Okta Applications (1 - 3)
ID Name Label Logo
0ob8zlypk6GVPRr2T0h7 workday Workday - Preview
0oabz0ozy5dDpEKyA0h7 workday Workday - Prod - DryRun
0oae3ioe51sQ64Aui2h7 workday Workday - Impl1

okta-list-user-applications

Returns a list of Okta applications data.

Base Command

okta-iam-list-user-applications

Input

Argument Name Description Required
user_id ID of the user for which to get the information. Required

Context Output

Path Type Description
Okta.Application.ID string ID of the application.
Okta.Application.Name string Name of the application.
Okta.Application.Label string Label of the application.
Okta.Application.Status string Status of the application.

Command Example

!okta-iam-list-user-applications user_id=00ux9v19bvTfQIjur0h7"

Human Readable Output

Okta User Applications
ID Name Label Status
0ob8zlypk6GVPRr2T0h7 active_directory pantest.local ACTIVE
0oabz0ozy5dDpEKyA0h7 test_app martsheet Test App ACTIVE

okta-iam-get-configuration

Gets the IAM configuration data from the integration context.

Base Command

okta-iam-get-configuration

Input

There are no input arguments for this command.

Context Output

Path Type Description
Okta.IAMConfiguration.ApplicationID String An Okta application ID.
Okta.IAMConfiguration.Name String Name of the Okta application.
Okta.IAMConfiguration.Label String Label of the Okta application.
Okta.IAMConfiguration.Logo String Logo of the application.
Okta.IAMConfiguration.Instance String An XSOAR IAM integration instance name.

Command Example

!okta-iam-get-configuration using="Okta IAM_instance_1_copy"

Human Readable Output

Okta IAM Configuration
ApplicationID Instance Label Logo Name
0oc8zlypk6GVPRr2G0h7 ServiceNow IAM_instance_1 ServiceNow servicenow

okta-iam-set-configuration

Updates IAM configuration data in the integration context.

Base Command

okta-iam-set-configuration

Input

Argument Name Description Required
configuration IAM configuration data. Required

Context Output

There is no context output for this command.

iam-get-group

Retrieves the group information, including its members.

Base Command

iam-get-group

Input

Argument Name Description Required
scim Group SCIM Data. Required
includeMembers Field to indicate if members need to be included in the response. . Possible values are: true, false. Default is true. Required

Context Output

Path Type Description
GetGroup.id String ID of the group.
GetGroup.displayName String The display name of the group.
GetGroup.members.display String The display name of the group member.
GetGroup.members.value String ID of the group member.
GetGroup.success Boolean Indicates whether the command succeeded.
GetGroup.errorCode Number HTTP error response code.
GetGroup.errorMessage String Reason why the API failed.

okta-get-logs

Gets logs by providing optional filters.

Base Command

okta-get-logs

Input

Argument Name Description Required
filter Useful for performing structured queries where constraints on LogEvent attribute values can be explicitly targeted. The following expressions are supported for events with the filter query parameter: eventType eq “ :eventType” -Events that have a specific action; eventType target.id eq “:id” - Events published with a specific target id; actor.id eq “:id”- Events published with a specific actor ID. For more information about filtering, visit https://developer.okta.com/docs/api/getting_started/design_principles#filtering. Optional
since Filters the lower time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z. Optional
until Filters the upper time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z. Optional
sortOrder The order of the returned events. Can be “ASCENDING” or “DESCENDING”. The default is “ASCENDING”. Possible values are: ASCENDING, DESCENDING. Default is ASCENDING. Optional
limit The maximum number of results to return. The default and maximum is 100. Optional

Context Output

Path Type Description
Okta.Logs.Events.actor.alternateId String Alternative ID of the actor.
Okta.Logs.Events.actor.displayName String Display name of the actor.
Okta.Logs.Events.actor.id String ID of the actor.
Okta.Logs.Events.client.userAgent.rawUserAgent String A raw string representation of user agent, formatted according to section 5.5.3 of HTTP/1.1 Semantics and Content. Both the browser and the OS fields can be derived from this field.
Okta.Logs.Events.client.userAgent.os String The operating system on which the client runs. For example, Microsoft Windows 10.
Okta.Logs.Events.client.userAgent.browser String Identifies the type of web browser, if relevant. For example, Chrome.
Okta.Logs.Events.client.device String Type of device from which the client operated. For example, Computer.
Okta.Logs.Events.client.id String For OAuth requests, the ID of the OAuth client making the request. For SSWS token requests, the ID of the agent making the request.
Okta.Logs.Events.client.ipAddress String IP address from which the client made its request.
Okta.Logs.Events.client.geographicalContext.city String The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
Okta.Logs.Events.client.geographicalContext.state String Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
Okta.Logs.Events.client.geographicalContext.country String Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
Okta.Logs.Events.displayMessage String The display message for an event.
Okta.Logs.Events.eventType String Type of event that was published.
Okta.Logs.Events.outcome.result String Result of the action. Can be “SUCCESS”, “FAILURE”, “SKIPPED”, or “UNKNOWN”.
Okta.Logs.Events.outcome.reason String Reason for the result. For example, INVALID_CREDENTIALS.
Okta.Logs.Events.published String Timestamp when the event was published.
Okta.Logs.Events.severity String The event severity. Can be “DEBUG”, “INFO”, “WARN”, or “ERROR”.
Okta.Logs.Events.securityContext.asNumber Number Autonomous system number associated with the autonomous system that the event request was sourced to.
Okta.Logs.Events.securityContext.asOrg String Organization associated with the autonomous system that the event request was sourced to.
Okta.Logs.Events.securityContext.isp String Internet service provider used to send the event’s request.
Okta.Logs.Events.securityContext.domain String Specifies whether an event’s request is from a known proxy.
Okta.Logs.Events.request.ipChain.IP String IP address.
Okta.Logs.Events.request.ipChain.geographicalContext.city String The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
Okta.Logs.Events.request.ipChain.geographicalContext.state String Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
Okta.Logs.Events.request.ipChain.geographicalContext.country String Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
Okta.Logs.Events.request.ipChain.source String Details regarding the source.
Okta.Logs.Events.target.id String ID of a target.
Okta.Logs.Events.target.type String Type of a target.
Okta.Logs.Events.target.alternateId String Alternative ID of a target.
Okta.Logs.Events.target.displayName String Display name of a target.

Configuration parameters

  • url — Okta URL (https://<domain>.okta.com) (required)
  • credentials —
  • apitoken — API Token (See detailed instructions)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • create-user-enabled — Allow creating users
  • update-user-enabled — Allow updating users
  • enable-user-enabled — Allow enabling users
  • disable-user-enabled — Allow disabling users
  • create-if-not-exists — Automatically create user if not found in update command
  • mapper-in — Incoming Mapper (required)
  • mapper-out — Outgoing Mapper (required)
  • max_fetch — Fetch limit (recommended value is less than 200)
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • auto_generate_query_filter — Query only application events configured in IAM Configuration
  • fetch_query_filter — Fetch Query Filter (Okta system log events)
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)

Commands (12)

  • get-mapping-fields

    Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

  • iam-create-user

    Creates a user.

  • iam-disable-user

    Disable an active user.

  • iam-get-group

    Retrieves the group information, including its members.

  • iam-get-user

    Retrieves a single user resource.

  • iam-update-user

    Updates an existing user with the data passed in the user-profile argument.

  • okta-get-app-user-assignment

    Returns information about application's user assignment.

  • okta-get-logs

    Gets logs by providing optional filters.

  • okta-iam-get-configuration

    Gets the IAM configuration data from the integration context.

  • okta-iam-list-applications

    Returns a list of Okta applications data.

  • okta-iam-list-user-applications

    List all applications assigned to a user.

  • okta-iam-set-configuration

    Updates IAM configuration data in the integration context.

Source

Okta_IAM.py Okta_IAM_test.py Okta_IAM.yml Okta_IAM_description.md
Download History Raw 
category: Authentication & Identity Management
provider: Okta
sectionorder:
- Connect
- Collect
commonfields:
  id: Okta IAM
  version: -1
configuration:
- display: Okta URL (https://<domain>.okta.com)
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Token (see detailed instructions)
  hiddenusername: true
  section: Connect
  required: false
- display: API Token (See detailed instructions)
  name: apitoken
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow creating users
  name: create-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow updating users
  name: update-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow enabling users
  name: enable-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow disabling users
  name: disable-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Automatically create user if not found in update command
  name: create-if-not-exists
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: User Profile - Okta (Incoming)
  display: Incoming Mapper
  name: mapper-in
  required: true
  type: 0
  section: Connect
- defaultvalue: User Profile - Okta (Outgoing)
  display: Outgoing Mapper
  name: mapper-out
  required: true
  type: 0
  section: Connect
- defaultvalue: '50'
  display: Fetch limit (recommended value is less than 200)
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Configure an "IAM - Configuration" incident to specify the Okta apps you wish to sync to XSOAR. Further information about IAM configuration is detailed in the Help (the "?" icon).
  defaultvalue: 'true'
  display: Query only application events configured in IAM Configuration
  name: auto_generate_query_filter
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'Use a query filter expression in SCIM format. Note: make sure the "Query only application events configured in IAM Configuration" is unchecked to use this parameter. See the Help (the "?" icon) to learn more about the filter parameter.'
  display: Fetch Query Filter (Okta system log events)
  name: fetch_query_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: 0 minutes
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
description: Integrate with Okta's Identity Access Management service to execute CRUD operations to employee lifecycle processes.
display: Okta IAM
name: Okta IAM
script:
  commands:
  - arguments:
    - description: User Profile indicator details.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Creates a user.
    execution: true
    name: iam-create-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Updates an existing user with the data passed in the user-profile argument.
    execution: true
    name: iam-update-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Retrieves a single user resource.
    name: iam-get-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - description: Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  - arguments:
    - description: ID of the user for which to get information.
      name: user_id
      required: true
    - description: ID of the application for which to get information.
      name: application_id
      required: true
    description: Returns information about application's user assignment.
    name: okta-get-app-user-assignment
    outputs:
    - contextPath: Okta.AppUserAssignment.UserID
      description: ID of the user.
      type: string
    - contextPath: Okta.AppUserAssignment.AppID
      description: ID of the application.
      type: string
    - contextPath: Okta.AppUserAssignment.IsAssigned
      description: When True, indicates that the user is assigned to the application.
      type: boolean
    - contextPath: Okta.AppUserAssignment.ProfileInApp
      description: The user profile data in the application.
      type: unknown
  - arguments:
    - description: Search for applications by their names.
      name: query
    - defaultValue: '0'
      description: Page number (0-based).
      name: page
    - defaultValue: '50'
      description: Maximum number of apps to retrieve (maximal value is 200).
      name: limit
    description: Returns a list of Okta applications data.
    name: okta-iam-list-applications
    outputs:
    - contextPath: Okta.Application.ID
      description: ID of the application.
      type: string
    - contextPath: Okta.Application.Name
      description: Name of the application.
      type: string
    - contextPath: Okta.Application.Label
      description: Label of the application.
      type: string
    - contextPath: Okta.Application.Logo
      description: Logo of the application.
      type: string
  - arguments:
    - description: IAM configuration data.
      name: configuration
      required: true
    description: Updates IAM configuration data in the integration context.
    name: okta-iam-set-configuration
  - description: Gets the IAM configuration data from the integration context.
    name: okta-iam-get-configuration
    outputs:
    - contextPath: Okta.IAMConfiguration.ApplicationID
      description: An Okta application ID.
      type: String
    - contextPath: Okta.IAMConfiguration.Name
      description: Name of the Okta application.
      type: String
    - contextPath: Okta.IAMConfiguration.Label
      description: Label of the Okta application.
      type: String
    - contextPath: Okta.IAMConfiguration.Logo
      description: Logo of the application.
      type: String
    - contextPath: Okta.IAMConfiguration.Instance
      description: An XSOAR IAM integration instance name.
      type: String
  - arguments:
    - description: ID of the user for which to get the information.
      name: user_id
      required: true
    description: List all applications assigned to a user.
    name: okta-iam-list-user-applications
    outputs:
    - contextPath: Okta.Application.ID
      description: ID of the application.
      type: String
    - contextPath: Okta.Application.Label
      description: Label of the application.
      type: String
    - contextPath: Okta.Application.Name
      description: Name of the application.
      type: String
    - contextPath: Okta.Application.Status
      description: Status of the application.
      type: String
  - arguments:
    - description: Group SCIM Data.
      name: scim
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Field to indicate if members need to be included in the response. '
      name: includeMembers
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Retrieves the group information, including its members.
    name: iam-get-group
    outputs:
    - contextPath: GetGroup.id
      description: ID of the group.
      type: String
    - contextPath: GetGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: GetGroup.members.display
      description: The display name of the group member.
      type: String
    - contextPath: GetGroup.members.value
      description: ID of the group member.
      type: String
    - contextPath: GetGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: GetGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: GetGroup.errorMessage
      description: Reason why the API failed.
      type: String
  - arguments:
    - description: 'Useful for performing structured queries where constraints on LogEvent attribute values can be explicitly targeted.  The following expressions are supported for events with the filter query parameter: eventType eq " :eventType" -Events that have a specific action; eventType target.id eq ":id" - Events published with a specific target id; actor.id eq ":id"- Events published with a specific actor ID. For more information about filtering, visit https://developer.okta.com/docs/api/getting_started/design_principles#filtering'
      name: filter
    - description: 'Filters the lower time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z.'
      name: since
    - description: 'Filters the upper time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z.'
      name: until
    - auto: PREDEFINED
      defaultValue: ASCENDING
      description: The order of the returned events. Can be "ASCENDING" or "DESCENDING". The default is "ASCENDING".
      name: sortOrder
      predefined:
      - ASCENDING
      - DESCENDING
    - defaultValue: '100'
      description: The maximum number of results to return, between 0 and 1000 maximum. The default is 100.
      name: limit
    description: Gets logs by providing optional filters.
    name: okta-get-logs
    outputs:
    - contextPath: Okta.Logs.Events.actor.alternateId
      description: Alternative ID of the actor.
      type: String
    - contextPath: Okta.Logs.Events.actor.displayName
      description: Display name of the actor.
      type: String
    - contextPath: Okta.Logs.Events.actor.id
      description: ID of the actor.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.rawUserAgent
      description: A raw string representation of user agent, formatted according to section 5.5.3 of HTTP/1.1 Semantics and Content. Both the browser and the OS fields can be derived from this field.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.os
      description: The operating system on which the client runs. For example, Microsoft Windows 10.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.browser
      description: Identifies the type of web browser, if relevant. For example, Chrome.
      type: String
    - contextPath: Okta.Logs.Events.client.device
      description: Type of device from which the client operated. For example, Computer.
      type: String
    - contextPath: Okta.Logs.Events.client.id
      description: For OAuth requests, the ID of the OAuth client making the request. For SSWS token requests, the ID of the agent making the request.
      type: String
    - contextPath: Okta.Logs.Events.client.ipAddress
      description: IP address from which the client made its request.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.city
      description: The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.state
      description: Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.country
      description: Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
      type: String
    - contextPath: Okta.Logs.Events.displayMessage
      description: The display message for an event.
      type: String
    - contextPath: Okta.Logs.Events.eventType
      description: Type of event that was published.
      type: String
    - contextPath: Okta.Logs.Events.outcome.result
      description: Result of the action. Can be "SUCCESS", "FAILURE", "SKIPPED", or "UNKNOWN".
      type: String
    - contextPath: Okta.Logs.Events.outcome.reason
      description: Reason for the result. For example, INVALID_CREDENTIALS.
      type: String
    - contextPath: Okta.Logs.Events.published
      description: Timestamp when the event was published.
      type: String
    - contextPath: Okta.Logs.Events.severity
      description: The event severity. Can be "DEBUG", "INFO", "WARN", or "ERROR".
      type: String
    - contextPath: Okta.Logs.Events.securityContext.asNumber
      description: Autonomous system number associated with the autonomous system that the event request was sourced to.
      type: Number
    - contextPath: Okta.Logs.Events.securityContext.asOrg
      description: Organization associated with the autonomous system that the event request was sourced to.
      type: String
    - contextPath: Okta.Logs.Events.securityContext.isp
      description: Internet service provider used to send the event's request.
      type: String
    - contextPath: Okta.Logs.Events.securityContext.domain
      description: Specifies whether an event's request is from a known proxy.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.IP
      description: IP address.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.city
      description: The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.state
      description: Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.country
      description: Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.source
      description: Details regarding the source.
      type: String
    - contextPath: Okta.Logs.Events.target.id
      description: ID of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.type
      description: Type of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.alternateId
      description: Alternative ID of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.displayName
      description: Display name of a target.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncout: true
tests:
- Okta IAM - Test Playbook
defaultmapperin: Okta IAM - App Sync (mapper)
defaultclassifier: Okta IAM - App Sync (classifier)
fromversion: 6.0.0