commonfields:
  id: Okta Event Collector
  version: -1
sectionorder:
- Connect
- Collect
name: Okta Event Collector
display: Okta Event Collector
category: Analytics & SIEM
provider: Okta
description: Collects the events log for authentication and Audit provided by Okta admin API.
configuration:
- display: Server URL
  name: url
  type: 0
  required: true
  section: Connect
  additionalinfo: The Okta API base domain, for example https://<domain>.com. Do not append /api/v1/logs; the integration adds it automatically.
- displaypassword: API key
  name: api_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: Number of events to fetch per fetch
  name: limit
  type: 0
  defaultvalue: 10000
  required: true
  additionalinfo: 'The total number of events to retrieve in each fetch cycle. The integration paginates automatically; the Okta API returns at most 1000 records per request.'
  section: Collect
- display: First fetch from API time
  name: after
  type: 15
  defaultvalue: 1 day
  required: true
  options:
  - 1 minute
  - 1 hour
  - 1 day
  - 3 day
  - 5 day
  - 1 week
  - 1 month
  - 1 year
  section: Collect
- display: Trust any certificate (not secure)
  name: verify
  type: 8
  defaultvalue: "true"
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  defaultvalue: 1
  section: Collect
  advanced: true
  required: false
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - defaultValue: '5 minutes ago'
      description: 'The start time from which to retrieve events. Supports relative time (for example, "5 minutes ago", "3 days ago") or ISO 8601 (for example, "2026-01-01T10:00:00Z").'
      name: start_time
      required: false
    - description: 'The end time until which to retrieve events. Supports relative time (for example, "1 hour ago") or ISO 8601 (for example, "2026-01-01T12:00:00Z"). Defaults to the present moment.'
      name: end_time
      required: false
    - description: The maximum number of events to retrieve. Defaults to the instance level limit.
      name: limit
      required: false
    - description: 'Deprecated. Use the start_time argument instead.'
      deprecated: true
      name: from_date
      required: false
    description: Manual command to fetch events and display them. Use for development and debugging only, as it may produce duplicate events or disrupt the fetch mechanism.
    name: okta-get-events
    outputs:
    - contextPath: Okta.Event.uuid
      description: Unique identifier of the event.
      type: String
    - contextPath: Okta.Event.published
      description: Timestamp when the event was published.
      type: Date
    - contextPath: Okta.Event.eventType
      description: The type of the event.
      type: String
    - contextPath: Okta.Event.displayMessage
      description: Human readable description of the event.
      type: String
    - contextPath: Okta.Event.severity
      description: The severity of the event.
      type: String
  dockerimage: demisto/fastapi:0.125.0.10158186
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
fromversion: 6.8.0
tests:
- No tests