Okta - User Investigation

This playbook performs an investigation on a specific user, using queries and logs from Okta.

Okta · 40 tasks · 3 inputs · 10 outputs

Details

IDOkta - User Investigation
From Version6.5.0
Tasks40

README

This playbook performs an investigation on a specific user, using queries and logs from Okta.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Okta v2

Scripts

  • CountArraySize
  • Set
  • GetTime

Commands

  • okta-get-logs

Playbook Inputs

Name Description Default Value Required
UserEmail The user email to search Okta logs.   Optional
LoginCountry The Country code from which the user logged in.
Country Code Alpha 2 (Example: US)		   Optional
ASN The ASN from which the user logged in.   Optional

Playbook Outputs

Path Description Type
PermanentCountry True if the user work from a permanent country. False if else. unknown
UserDevices Devices used by the user. unknown
NumOfOktaSuspiciousActivities Number of Suspicious Activities for the user. unknown
SuspiciousUserActivities Suspicious Activities for the user. unknown
NumOfOktaSuspiciousUserAgent Number of Suspicious User Agent. unknown
SuspiciousUserAgent Suspicious User Agent. unknown
UserApplication Applications used by the user. unknown
NumOfOktaFailedLogon Number of failed login. unknown
NumOfFailedLogonASN Number of failed login from ASN by all users. unknown
LogonCountries The countries from which the user logged in. unknown

Playbook Image

Okta - User Investigation

Inputs

  • UserEmail — The user email to search Okta logs.
  • LoginCountry — The Country code from which the user logged in. Country Code Alpha 2 (Example: US)
  • ASN — The ASN from which the user logged in.

Outputs

  • PermanentCountry — True if the user work from a permanent country. False if else.
  • UserDevices — Devices used by the user.
  • NumOfOktaSuspiciousActivities — Number of Suspicious Activities for the user.
  • SuspiciousUserActivities — Suspicious Activities for the user.
  • NumOfOktaSuspiciousUserAgent — Number of Suspicious User Agent.
  • SuspiciousUserAgent — Suspicious User Agent.
  • UserApplication — Applications used by the user.
  • NumOfOktaFailedLogon — Number of failed login.
  • NumOfFailedLogonASN — Number of failed login from ASN by all users.
  • LogonCountries — The countries from which the user logged in.

Commands used

okta-get-logs

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Permanent Location Check Permanent Location Check Is Okta V2 integration enabled and the user email is defined? Is Okta V2 integration en... The user work from a permanent country? The user work from a perm... Set not a permanent country - Set Set not a permanent country Set Set permanent country - Set Set permanent country Set Suspicious activity Search Suspicious activity Search Check for suspicious activities - okta-get-logs Check for suspicious acti... okta-get-logs Found results from Okta? Found results from Okta? Count Okta Suspicious activity - CountArraySize Count Okta Suspicious act... CountArraySize Check for suspicious user agent access app - okta-get-logs Check for suspicious user... okta-get-logs Found results from Okta? Found results from Okta? Count Okta Suspicious User Agent - CountArraySize Count Okta Suspicious Use... CountArraySize Done Done Device Search Device Search Get current time - GetTime Get current time GetTime Get time 1 day ago - GetTime Get time 1 day ago GetTime Get time 7 days ago - GetTime Get time 7 days ago GetTime Okta User Investigation Okta User Investigation Set the Devices used by the user - Set Set the Devices used by t... Set Application Search Application Search Get Successful logon logs - okta-get-logs Get Successful logon logs okta-get-logs Found results from Okta? Found results from Okta? Set the Application used by the user - Set Set the Application used ... Set Set Okta Suspicious User Agent - Set Set Okta Suspicious User ... Set Set Okta Suspicious User Activities - Set Set Okta Suspicious User ... Set Failed logon Search Failed logon Search Search for failed logon attempts using OKTA - okta-get-logs Search for failed logon a... okta-get-logs Count Okta failed logon - CountArraySize Count Okta failed logon CountArraySize Found results from Okta? Found results from Okta? Time Calculation Time Calculation Successful Logon Search Successful Logon Search Check if the login country is defined Check if the login countr... Set Number Of Okta Failed Logon to Zero - Set Set Number Of Okta Failed... Set Failed Logon from ASN Search Failed Logon from ASN Search Check for all failed logon from ASN - okta-get-logs Check for all failed logo... okta-get-logs Count failed logon from ASN - CountArraySize Count failed logon from ASN CountArraySize Does the result from Okta exist? Does the result from Okta... Does the ASN is defined? Does the ASN is defined? Set the country from which the user logged in - Set Set the country from whic... Set

Source

playbook-Okta_-_User_Investigation.yml
Download History Raw 
id: Okta - User Investigation
version: -1
name: Okta - User Investigation
description: This playbook performs an investigation on a specific user, using queries and logs from Okta.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cd99ae77-4afb-4247-8428-f03e7108b363
    type: start
    task:
      id: cd99ae77-4afb-4247-8428-f03e7108b363
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: bb352d99-3d2e-4ae2-8b9b-4ecb8e2a970c
    type: title
    task:
      id: bb352d99-3d2e-4ae2-8b9b-4ecb8e2a970c
      version: -1
      name: Permanent Location Check
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "46"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 45411a85-7b8b-41fa-86a7-5024cdf8ee49
    type: condition
    task:
      id: 45411a85-7b8b-41fa-86a7-5024cdf8ee49
      version: -1
      name: Is Okta V2 integration enabled and the user email is defined?
      description: Checks if Okta V2 integration enabled and the user email is defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "9"
      - "33"
      - "38"
      - "41"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Okta v2
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.UserEmail
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 75
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: df7a7cad-4048-4344-8c25-e59d5ce8d039
    type: condition
    task:
      id: df7a7cad-4048-4344-8c25-e59d5ce8d039
      version: -1
      name: The user work from a permanent country?
      description: Check if the user work from a permanent country
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: in
          left:
            value:
              complex:
                root: inputs.LoginCountry
                transformers:
                - operator: ConvertCountryCodeCountryName
                  args:
                    country_code:
                      value:
                        simple: inputs.LoginCountry
                      iscontext: true
                    country_name: {}
            iscontext: true
          right:
            value:
              complex:
                root: LogonCountries
                transformers:
                - operator: uniq
            iscontext: true
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: caa1ca90-1d98-4c03-81b1-75dec09b999f
    type: regular
    task:
      id: caa1ca90-1d98-4c03-81b1-75dec09b999f
      version: -1
      name: Set not a permanent country
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: PermanentCountry
      value:
        simple: "False"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1830,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 58937974-7092-483c-8523-a209933add86
    type: regular
    task:
      id: 58937974-7092-483c-8523-a209933add86
      version: -1
      name: Set permanent country
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: PermanentCountry
      value:
        simple: "True"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1410,
          "y": 1475
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 3a7de498-117e-4882-8795-33c1743e8a0b
    type: title
    task:
      id: 3a7de498-117e-4882-8795-33c1743e8a0b
      version: -1
      name: Suspicious activity Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
      - "15"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 80cfc361-dfd8-4195-89d1-2b003e741f23
    type: regular
    task:
      id: 80cfc361-dfd8-4195-89d1-2b003e741f23
      version: -1
      name: Check for suspicious activities
      description: |-
        Link to Okta suspicious activity events list:
        https://help.okta.com/oie/en-us/Content/Topics/Reports/suspicious-activity-report.htm
      script: Okta v2|||okta-get-logs
      type: regular
      iscommand: true
      brand: Okta v2
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      extend-context:
        simple: OktaSuspiciousActivities=
      filter:
        simple: actor.alternateId eq "${inputs.UserEmail}" and (eventType eq "user.mfa.attempt_bypass" or eventType eq "user.account.reset_password" and outcome.result eq "FAILURE" and outcome.reason eq "User answered recovery question invalid")
      ignore-outputs:
        simple: "true"
      retry-count:
        simple: "6"
      retry-interval:
        simple: "10"
      since:
        complex:
          root: TimeLast1DayTimeNow
          transformers:
          - operator: LastArrayElement
      until:
        complex:
          root: CurrentTimeTimeNow
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 7f21a137-9c1a-4d38-8491-81bf80ba9f9b
    type: condition
    task:
      id: 7f21a137-9c1a-4d38-8491-81bf80ba9f9b
      version: -1
      name: Found results from Okta?
      description: Check if there are results from Okta
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "14"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: OktaSuspiciousActivities
                accessor: displayMessage
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 585
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 4fba2bf2-09f0-4ce9-894d-7512bf8d9d56
    type: regular
    task:
      id: 4fba2bf2-09f0-4ce9-894d-7512bf8d9d56
      version: -1
      name: Count Okta Suspicious activity
      description: Count an array size
      scriptName: CountArraySize
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      array:
        complex:
          root: OktaSuspiciousActivities
      contextKey:
        simple: NumOfOktaSuspiciousActivities
      ignore-outputs:
        simple: "false"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 66dd97fd-c5b8-40d3-8f97-3cbf81c10980
    type: regular
    task:
      id: 66dd97fd-c5b8-40d3-8f97-3cbf81c10980
      version: -1
      name: Check for suspicious user agent access app
      description: Gets logs by providing optional filters.
      script: Okta v2|||okta-get-logs
      type: regular
      iscommand: true
      brand: Okta v2
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      extend-context:
        simple: OktaUserAgentLogs=
      filter:
        simple: actor.alternateId eq "${inputs.UserEmail}" and (client.userAgent.rawUserAgent co "python" or client.userAgent.rawUserAgent co "curl"  or client.userAgent.rawUserAgent co "axios" or client.userAgent.rawUserAgent co "httpie" or client.userAgent.rawUserAgent co "wget")
      ignore-outputs:
        simple: "true"
      limit:
        simple: "5"
      retry-count:
        simple: "6"
      retry-interval:
        simple: "10"
      since:
        complex:
          root: TimeLast1DayTimeNow
          transformers:
          - operator: LastArrayElement
      until:
        complex:
          root: CurrentTimeTimeNow
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 270,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 31211bca-118e-40f2-891f-9a24bfb551a1
    type: condition
    task:
      id: 31211bca-118e-40f2-891f-9a24bfb551a1
      version: -1
      name: Found results from Okta?
      description: Check if there are results from Okta
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: OktaUserAgentLogs
                accessor: displayMessage
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 270,
          "y": 585
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 0d112b15-5b99-4fcd-873d-3a3a9aaac40e
    type: regular
    task:
      id: 0d112b15-5b99-4fcd-873d-3a3a9aaac40e
      version: -1
      name: Count Okta Suspicious User Agent
      description: Count an array size
      scriptName: CountArraySize
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      array:
        complex:
          root: OktaUserAgentLogs
      contextKey:
        simple: NumOfOktaSuspiciousUserAgent
      ignore-outputs:
        simple: "false"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 270,
          "y": 810
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 1acf6ae5-e83f-4695-8da6-5dd457df5f06
    type: title
    task:
      id: 1acf6ae5-e83f-4695-8da6-5dd457df5f06
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": 1660
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 3698725d-cf0f-473e-8926-8082fb0825b3
    type: title
    task:
      id: 3698725d-cf0f-473e-8926-8082fb0825b3
      version: -1
      name: Device Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2250,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: cb0f2304-b7c0-474d-8159-3d2be2d54c0b
    type: regular
    task:
      id: cb0f2304-b7c0-474d-8159-3d2be2d54c0b
      version: -1
      name: Get current time
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      contextKey:
        simple: CurrentTime
      dateFormat:
        simple: ISO
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 222c9b2e-ccd3-46ae-8d74-17fc6eb82454
    type: regular
    task:
      id: 222c9b2e-ccd3-46ae-8d74-17fc6eb82454
      version: -1
      name: Get time 1 day ago
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      contextKey:
        simple: TimeLast1Day
      dateFormat:
        simple: ISO
      daysAgo:
        simple: "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 67525eaa-a9c3-4582-821a-4afd9948994a
    type: regular
    task:
      id: 67525eaa-a9c3-4582-821a-4afd9948994a
      version: -1
      name: Get time 7 days ago
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      contextKey:
        simple: TimeLast1Week
      dateFormat:
        simple: ISO
      daysAgo:
        simple: "7"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 2710a4db-f66c-4934-8e19-d6d175901b72
    type: title
    task:
      id: 2710a4db-f66c-4934-8e19-d6d175901b72
      version: -1
      name: Okta User Investigation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 9c77ceef-3cdd-499b-8c32-e5d880566edf
    type: regular
    task:
      id: 9c77ceef-3cdd-499b-8c32-e5d880566edf
      version: -1
      name: Set the Devices used by the user
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: UserDevices
      value:
        complex:
          root: LogonLogs.client
          accessor: device
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2250,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 46e34908-9c66-4237-81ba-eff267880308
    type: title
    task:
      id: 46e34908-9c66-4237-81ba-eff267880308
      version: -1
      name: Application Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 825
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 62dd7273-0d11-49dd-884f-7376f905f5f8
    type: regular
    task:
      id: 62dd7273-0d11-49dd-884f-7376f905f5f8
      version: -1
      name: Get Successful logon logs
      description: Gets logs by providing optional filters.
      script: Okta v2|||okta-get-logs
      type: regular
      iscommand: true
      brand: Okta v2
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      extend-context:
        simple: LogonLogs=
      filter:
        simple: actor.alternateId eq "${inputs.UserEmail}" and (eventType eq "user.authentication.sso" and outcome.result eq "SUCCESS" or eventType eq "user.authentication.auth" and outcome.result eq "SUCCESS")
      ignore-outputs:
        simple: "true"
      retry-count:
        simple: "6"
      retry-interval:
        simple: "10"
      since:
        complex:
          root: TimeLast1WeekTimeNow
          transformers:
          - operator: LastArrayElement
      until:
        complex:
          root: TimeLast1DayTimeNow
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 0041246d-5e88-41b0-8d34-fdd1f164b927
    type: condition
    task:
      id: 0041246d-5e88-41b0-8d34-fdd1f164b927
      version: -1
      name: Found results from Okta?
      description: Check if there are results from Okta
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "27"
      - "1"
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: LogonLogs
                accessor: displayMessage
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 600
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: b7271f0d-5d5a-48f3-8903-6529d8e8110a
    type: regular
    task:
      id: b7271f0d-5d5a-48f3-8903-6529d8e8110a
      version: -1
      name: Set the Application used by the user
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: UserApplication
      value:
        complex:
          root: LogonLogs.target
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: LogonLogs.target.type
                iscontext: true
              right:
                value:
                  simple: AppInstance
              ignorecase: true
          accessor: displayName
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1040,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 3381ed86-2f8f-4cd6-8746-3eb867d67102
    type: regular
    task:
      id: 3381ed86-2f8f-4cd6-8746-3eb867d67102
      version: -1
      name: Set Okta Suspicious User Agent
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: ' SuspiciousUserAgent'
      value:
        complex:
          root: OktaUserAgentLogs.client.userAgent
          accessor: rawUserAgent
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 270,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 3826aebf-3833-4575-8992-6627102fd132
    type: regular
    task:
      id: 3826aebf-3833-4575-8992-6627102fd132
      version: -1
      name: Set Okta Suspicious User Activities
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: ' SuspiciousUserActivities'
      value:
        complex:
          root: OktaSuspiciousActivities
          accessor: displayMessage
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -180,
          "y": 975
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: dc1f4b9d-9baa-461e-82a4-88370a100652
    type: title
    task:
      id: dc1f4b9d-9baa-461e-82a4-88370a100652
      version: -1
      name: Failed logon Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -820,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 60f59adf-a233-4d7f-87ee-43d559400184
    type: regular
    task:
      id: 60f59adf-a233-4d7f-87ee-43d559400184
      version: -1
      name: Search for failed logon attempts using OKTA
      description: Gets logs on failed logon events.
      script: Okta v2|||okta-get-logs
      type: regular
      iscommand: true
      brand: Okta v2
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      extend-context:
        simple: OktaFailedLogonLogs=
      filter:
        simple: actor.alternateId eq "${inputs.UserEmail}" and (eventType eq "user.authentication.sso" and outcome.result eq "FAILURE" or eventType eq "user.authentication.auth" and outcome.result eq "FAILURE")
      ignore-outputs:
        simple: "true"
      retry-count:
        simple: "6"
      retry-interval:
        simple: "10"
      since:
        complex:
          root: TimeLast1DayTimeNow
          transformers:
          - operator: LastArrayElement
      until:
        complex:
          root: CurrentTimeTimeNow
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -820,
          "y": 420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: c021863b-857c-454b-8773-52728869bf46
    type: regular
    task:
      id: c021863b-857c-454b-8773-52728869bf46
      version: -1
      name: Count Okta failed logon
      description: Count an array size
      scriptName: CountArraySize
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      array:
        complex:
          root: OktaFailedLogonLogs
      contextKey:
        simple: NumOfOktaFailedLogon
      ignore-outputs:
        simple: "false"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -620,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 9ca75b6a-4c9f-44dd-8476-97ff2f499c6e
    type: condition
    task:
      id: 9ca75b6a-4c9f-44dd-8476-97ff2f499c6e
      version: -1
      name: Found results from Okta?
      description: Check if there are results from Okta
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "40"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: OktaFailedLogonLogs
                accessor: displayMessage
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -820,
          "y": 585
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: f2126e24-e834-4c30-8d6c-4c9644825c07
    type: title
    task:
      id: f2126e24-e834-4c30-8d6c-4c9644825c07
      version: -1
      name: Time Calculation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 600,
          "y": -740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: 1b5d4215-d639-41b4-8f2f-bbc2238c47f1
    type: title
    task:
      id: 1b5d4215-d639-41b4-8f2f-bbc2238c47f1
      version: -1
      name: Successful Logon Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 1ac922e4-2893-48be-8e9c-ee8965499f20
    type: condition
    task:
      id: 1ac922e4-2893-48be-8e9c-ee8965499f20
      version: -1
      name: Check if the login country is defined
      description: Check if the login country is defined.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.LoginCountry
            iscontext: true
          right:
            value: {}
          ignorecase: true
      - - operator: isNotEqualString
          left:
            value:
              complex:
                root: inputs.LoginCountry
            iscontext: true
          right:
            value:
              simple: Unknown
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 1125
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 25a5abbc-d30d-4012-8acf-75488d58aed8
    type: regular
    task:
      id: 25a5abbc-d30d-4012-8acf-75488d58aed8
      version: -1
      name: Set Number Of Okta Failed Logon to Zero
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      key:
        simple: NumOfOktaFailedLogon
      value:
        simple: "0"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1020,
          "y": 805
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 13072b32-dac0-4c4d-8c5a-cc0b5de7d1a0
    type: title
    task:
      id: 13072b32-dac0-4c4d-8c5a-cc0b5de7d1a0
      version: -1
      name: Failed Logon from ASN Search
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "45"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1480,
          "y": 265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 256398af-e248-438b-8e7a-c72f9c238635
    type: regular
    task:
      id: 256398af-e248-438b-8e7a-c72f9c238635
      version: -1
      name: Check for all failed logon from ASN
      description: Gets logs by providing optional filters.
      script: Okta v2|||okta-get-logs
      type: regular
      iscommand: true
      brand: Okta v2
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      extend-context:
        simple: ASNfailedlogs=
      filter:
        simple: securityContext.asNumber eq "${inputs.ASN}" and (eventType eq "user.authentication.sso" and outcome.result eq "FAILURE" or eventType eq "user.authentication.auth" and outcome.result eq "FAILURE")
      ignore-outputs:
        simple: "true"
      retry-count:
        simple: "6"
      retry-interval:
        simple: "10"
      since:
        complex:
          root: TimeLast1DayTimeNow
          transformers:
          - operator: LastArrayElement
      until:
        complex:
          root: CurrentTimeTimeNow
          transformers:
          - operator: LastArrayElement
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1480,
          "y": 610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 59d70330-75bc-4ff7-8558-c57b4e6c4a8a
    type: regular
    task:
      id: 59d70330-75bc-4ff7-8558-c57b4e6c4a8a
      version: -1
      name: Count failed logon from ASN
      description: Count an array size
      scriptName: CountArraySize
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      array:
        complex:
          root: ASNfailedlogs
      contextKey:
        simple: NumOfFailedLogonASN
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1480,
          "y": 1035
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: b4510d1e-8338-40f9-856d-1e08db99747a
    type: condition
    task:
      id: b4510d1e-8338-40f9-856d-1e08db99747a
      version: -1
      name: Does the result from Okta exist?
      description: Check if there are results from Okta.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: ASNfailedlogs
                accessor: displayMessage
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1480,
          "y": 815
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: bb29f22a-c8db-4192-8345-462cb2453443
    type: condition
    task:
      id: bb29f22a-c8db-4192-8345-462cb2453443
      version: -1
      name: Does the ASN is defined?
      description: Check if there are results from Okta.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "18"
      "yes":
      - "42"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.ASN
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1480,
          "y": 430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 7b87796a-14dc-4b4c-8840-5080191f1ee6
    type: regular
    task:
      id: 7b87796a-14dc-4b4c-8840-5080191f1ee6
      version: -1
      name: Set the country from which the user logged in
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      key:
        simple: LogonCountries
      value:
        complex:
          root: LogonLogs.client.geographicalContext
          accessor: country
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1620,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "13_18_#default#": 0.16,
      "16_18_#default#": 0.22,
      "29_18_#default#": 0.53,
      "2_18_#default#": 0.16,
      "2_41_yes": 0.9,
      "36_35_yes": 0.47,
      "36_40_#default#": 0.47,
      "39_18_#default#": 0.16,
      "39_4_yes": 0.44,
      "44_18_#default#": 0.1,
      "44_43_yes": 0.58,
      "45_18_#default#": 0.1,
      "45_42_yes": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 2605,
        "width": 4110,
        "x": -1480,
        "y": -880
      }
    }
  }
inputs:
- key: UserEmail
  value: {}
  required: false
  description: The user email to search Okta logs.
  playbookInputQuery:
- key: LoginCountry
  value: {}
  required: false
  description: |-
    The Country code from which the user logged in.
    Country Code Alpha 2 (Example: US)
  playbookInputQuery:
- key: ASN
  value: {}
  required: false
  description: The ASN from which the user logged in.
  playbookInputQuery:
outputs:
- contextPath: PermanentCountry
  description: True if the user work from a permanent country. False if else.
  type: unknown
- contextPath: UserDevices
  description: Devices used by the user.
  type: unknown
- contextPath: NumOfOktaSuspiciousActivities
  description: Number of Suspicious Activities for the user.
  type: unknown
- contextPath: ' SuspiciousUserActivities'
  description: Suspicious Activities for the user.
  type: unknown
- contextPath: NumOfOktaSuspiciousUserAgent
  description: Number of Suspicious User Agent.
  type: unknown
- contextPath: SuspiciousUserAgent
  description: Suspicious User Agent.
  type: unknown
- contextPath: UserApplication
  description: ' Applications used by the user.'
  type: unknown
- contextPath: NumOfOktaFailedLogon
  description: Number of failed login.
  type: unknown
- contextPath: NumOfFailedLogonASN
  description: Number of failed login from ASN by all users.
  type: unknown
- contextPath: LogonCountries
  description: The countries from which the user logged in.
  type: unknown
quiet: true
tests:
- No tests (auto formatted)
fromversion: 6.5.0
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security