Okta - User Investigation

This playbook performs an investigation on a specific user, using queries and logs from Okta.

Okta · 40 tasks · 3 inputs · 10 outputs

Inputs

  • UserEmail — The user email to search Okta logs.
  • LoginCountry — The Country code from which the user logged in. Country Code Alpha 2 (Example: US)
  • ASN — The ASN from which the user logged in.

Outputs

  • PermanentCountry — True if the user work from a permanent country. False if else.
  • UserDevices — Devices used by the user.
  • NumOfOktaSuspiciousActivities — Number of Suspicious Activities for the user.
  • SuspiciousUserActivities — Suspicious Activities for the user.
  • NumOfOktaSuspiciousUserAgent — Number of Suspicious User Agent.
  • SuspiciousUserAgent — Suspicious User Agent.
  • UserApplication — Applications used by the user.
  • NumOfOktaFailedLogon — Number of failed login.
  • NumOfFailedLogonASN — Number of failed login from ASN by all users.
  • LogonCountries — The countries from which the user logged in.

Commands used

okta-get-logs

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Permanent Location Check Permanent Location Check Is Okta V2 integration enabled and the user email is defined? Is Okta V2 integration en... The user work from a permanent country? The user work from a perm... Set not a permanent country - Set Set not a permanent country Set Set permanent country - Set Set permanent country Set Suspicious activity Search Suspicious activity Search Check for suspicious activities - okta-get-logs Check for suspicious acti... okta-get-logs Found results from Okta? Found results from Okta? Count Okta Suspicious activity - CountArraySize Count Okta Suspicious act... CountArraySize Check for suspicious user agent access app - okta-get-logs Check for suspicious user... okta-get-logs Found results from Okta? Found results from Okta? Count Okta Suspicious User Agent - CountArraySize Count Okta Suspicious Use... CountArraySize Done Done Device Search Device Search Get current time - GetTime Get current time GetTime Get time 1 day ago - GetTime Get time 1 day ago GetTime Get time 7 days ago - GetTime Get time 7 days ago GetTime Okta User Investigation Okta User Investigation Set the Devices used by the user - Set Set the Devices used by t... Set Application Search Application Search Get Successful logon logs - okta-get-logs Get Successful logon logs okta-get-logs Found results from Okta? Found results from Okta? Set the Application used by the user - Set Set the Application used ... Set Set Okta Suspicious User Agent - Set Set Okta Suspicious User ... Set Set Okta Suspicious User Activities - Set Set Okta Suspicious User ... Set Failed logon Search Failed logon Search Search for failed logon attempts using OKTA - okta-get-logs Search for failed logon a... okta-get-logs Count Okta failed logon - CountArraySize Count Okta failed logon CountArraySize Found results from Okta? Found results from Okta? Time Calculation Time Calculation Successful Logon Search Successful Logon Search Check if the login country is defined Check if the login countr... Set Number Of Okta Failed Logon to Zero - Set Set Number Of Okta Failed... Set Failed Logon from ASN Search Failed Logon from ASN Search Check for all failed logon from ASN - okta-get-logs Check for all failed logo... okta-get-logs Count failed logon from ASN - CountArraySize Count failed logon from ASN CountArraySize Does the result from Okta exist? Does the result from Okta... Does the ASN is defined? Does the ASN is defined? Set the country from which the user logged in - Set Set the country from whic... Set