category: Authentication & Identity Management
provider: Okta
sectionorder:
- Connect
- Collect
commonfields:
  id: Okta IAM
  version: -1
configuration:
- display: Okta URL (https://<domain>.okta.com)
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Token (see detailed instructions)
  hiddenusername: true
  section: Connect
  required: false
- display: API Token (See detailed instructions)
  name: apitoken
  type: 4
  hidden: true
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow creating users
  name: create-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow updating users
  name: update-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow enabling users
  name: enable-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow disabling users
  name: disable-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Automatically create user if not found in update command
  name: create-if-not-exists
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: User Profile - Okta (Incoming)
  display: Incoming Mapper
  name: mapper-in
  required: true
  type: 0
  section: Connect
- defaultvalue: User Profile - Okta (Outgoing)
  display: Outgoing Mapper
  name: mapper-out
  required: true
  type: 0
  section: Connect
- defaultvalue: '50'
  display: Fetch limit (recommended value is less than 200)
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Configure an "IAM - Configuration" incident to specify the Okta apps you wish to sync to XSOAR. Further information about IAM configuration is detailed in the Help (the "?" icon).
  defaultvalue: 'true'
  display: Query only application events configured in IAM Configuration
  name: auto_generate_query_filter
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'Use a query filter expression in SCIM format. Note: make sure the "Query only application events configured in IAM Configuration" is unchecked to use this parameter. See the Help (the "?" icon) to learn more about the filter parameter.'
  display: Fetch Query Filter (Okta system log events)
  name: fetch_query_filter
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: 0 minutes
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  section: Collect
  required: false
description: Integrate with Okta's Identity Access Management service to execute CRUD operations to employee lifecycle processes.
display: Okta IAM
name: Okta IAM
script:
  commands:
  - arguments:
    - description: User Profile indicator details.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Creates a user.
    execution: true
    name: iam-create-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Updates an existing user with the data passed in the user-profile argument.
    execution: true
    name: iam-update-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Retrieves a single user resource.
    name: iam-get-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - description: Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  - arguments:
    - description: ID of the user for which to get information.
      name: user_id
      required: true
    - description: ID of the application for which to get information.
      name: application_id
      required: true
    description: Returns information about application's user assignment.
    name: okta-get-app-user-assignment
    outputs:
    - contextPath: Okta.AppUserAssignment.UserID
      description: ID of the user.
      type: string
    - contextPath: Okta.AppUserAssignment.AppID
      description: ID of the application.
      type: string
    - contextPath: Okta.AppUserAssignment.IsAssigned
      description: When True, indicates that the user is assigned to the application.
      type: boolean
    - contextPath: Okta.AppUserAssignment.ProfileInApp
      description: The user profile data in the application.
      type: unknown
  - arguments:
    - description: Search for applications by their names.
      name: query
    - defaultValue: '0'
      description: Page number (0-based).
      name: page
    - defaultValue: '50'
      description: Maximum number of apps to retrieve (maximal value is 200).
      name: limit
    description: Returns a list of Okta applications data.
    name: okta-iam-list-applications
    outputs:
    - contextPath: Okta.Application.ID
      description: ID of the application.
      type: string
    - contextPath: Okta.Application.Name
      description: Name of the application.
      type: string
    - contextPath: Okta.Application.Label
      description: Label of the application.
      type: string
    - contextPath: Okta.Application.Logo
      description: Logo of the application.
      type: string
  - arguments:
    - description: IAM configuration data.
      name: configuration
      required: true
    description: Updates IAM configuration data in the integration context.
    name: okta-iam-set-configuration
  - description: Gets the IAM configuration data from the integration context.
    name: okta-iam-get-configuration
    outputs:
    - contextPath: Okta.IAMConfiguration.ApplicationID
      description: An Okta application ID.
      type: String
    - contextPath: Okta.IAMConfiguration.Name
      description: Name of the Okta application.
      type: String
    - contextPath: Okta.IAMConfiguration.Label
      description: Label of the Okta application.
      type: String
    - contextPath: Okta.IAMConfiguration.Logo
      description: Logo of the application.
      type: String
    - contextPath: Okta.IAMConfiguration.Instance
      description: An XSOAR IAM integration instance name.
      type: String
  - arguments:
    - description: ID of the user for which to get the information.
      name: user_id
      required: true
    description: List all applications assigned to a user.
    name: okta-iam-list-user-applications
    outputs:
    - contextPath: Okta.Application.ID
      description: ID of the application.
      type: String
    - contextPath: Okta.Application.Label
      description: Label of the application.
      type: String
    - contextPath: Okta.Application.Name
      description: Name of the application.
      type: String
    - contextPath: Okta.Application.Status
      description: Status of the application.
      type: String
  - arguments:
    - description: Group SCIM Data.
      name: scim
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Field to indicate if members need to be included in the response. '
      name: includeMembers
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Retrieves the group information, including its members.
    name: iam-get-group
    outputs:
    - contextPath: GetGroup.id
      description: ID of the group.
      type: String
    - contextPath: GetGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: GetGroup.members.display
      description: The display name of the group member.
      type: String
    - contextPath: GetGroup.members.value
      description: ID of the group member.
      type: String
    - contextPath: GetGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: GetGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: GetGroup.errorMessage
      description: Reason why the API failed.
      type: String
  - arguments:
    - description: 'Useful for performing structured queries where constraints on LogEvent attribute values can be explicitly targeted.  The following expressions are supported for events with the filter query parameter: eventType eq " :eventType" -Events that have a specific action; eventType target.id eq ":id" - Events published with a specific target id; actor.id eq ":id"- Events published with a specific actor ID. For more information about filtering, visit https://developer.okta.com/docs/api/getting_started/design_principles#filtering'
      name: filter
    - description: 'Filters the lower time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z.'
      name: since
    - description: 'Filters the upper time bound of the log events in the Internet Date/Time Format profile of ISO 8601. For example: 2017-05-03T16:22:18Z.'
      name: until
    - auto: PREDEFINED
      defaultValue: ASCENDING
      description: The order of the returned events. Can be "ASCENDING" or "DESCENDING". The default is "ASCENDING".
      name: sortOrder
      predefined:
      - ASCENDING
      - DESCENDING
    - defaultValue: '100'
      description: The maximum number of results to return, between 0 and 1000 maximum. The default is 100.
      name: limit
    description: Gets logs by providing optional filters.
    name: okta-get-logs
    outputs:
    - contextPath: Okta.Logs.Events.actor.alternateId
      description: Alternative ID of the actor.
      type: String
    - contextPath: Okta.Logs.Events.actor.displayName
      description: Display name of the actor.
      type: String
    - contextPath: Okta.Logs.Events.actor.id
      description: ID of the actor.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.rawUserAgent
      description: A raw string representation of user agent, formatted according to section 5.5.3 of HTTP/1.1 Semantics and Content. Both the browser and the OS fields can be derived from this field.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.os
      description: The operating system on which the client runs. For example, Microsoft Windows 10.
      type: String
    - contextPath: Okta.Logs.Events.client.userAgent.browser
      description: Identifies the type of web browser, if relevant. For example, Chrome.
      type: String
    - contextPath: Okta.Logs.Events.client.device
      description: Type of device from which the client operated. For example, Computer.
      type: String
    - contextPath: Okta.Logs.Events.client.id
      description: For OAuth requests, the ID of the OAuth client making the request. For SSWS token requests, the ID of the agent making the request.
      type: String
    - contextPath: Okta.Logs.Events.client.ipAddress
      description: IP address from which the client made its request.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.city
      description: The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.state
      description: Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
      type: String
    - contextPath: Okta.Logs.Events.client.geographicalContext.country
      description: Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
      type: String
    - contextPath: Okta.Logs.Events.displayMessage
      description: The display message for an event.
      type: String
    - contextPath: Okta.Logs.Events.eventType
      description: Type of event that was published.
      type: String
    - contextPath: Okta.Logs.Events.outcome.result
      description: Result of the action. Can be "SUCCESS", "FAILURE", "SKIPPED", or "UNKNOWN".
      type: String
    - contextPath: Okta.Logs.Events.outcome.reason
      description: Reason for the result. For example, INVALID_CREDENTIALS.
      type: String
    - contextPath: Okta.Logs.Events.published
      description: Timestamp when the event was published.
      type: String
    - contextPath: Okta.Logs.Events.severity
      description: The event severity. Can be "DEBUG", "INFO", "WARN", or "ERROR".
      type: String
    - contextPath: Okta.Logs.Events.securityContext.asNumber
      description: Autonomous system number associated with the autonomous system that the event request was sourced to.
      type: Number
    - contextPath: Okta.Logs.Events.securityContext.asOrg
      description: Organization associated with the autonomous system that the event request was sourced to.
      type: String
    - contextPath: Okta.Logs.Events.securityContext.isp
      description: Internet service provider used to send the event's request.
      type: String
    - contextPath: Okta.Logs.Events.securityContext.domain
      description: Specifies whether an event's request is from a known proxy.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.IP
      description: IP address.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.city
      description: The city encompassing the area containing the geo-location coordinates, if available. For example, Seattle, San Francisco.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.state
      description: Full name of the state or province encompassing the area containing the geo-location coordinates. For example, Montana, Incheon.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.geographicalContext.country
      description: Full name of the country encompassing the area containing the geo-location coordinates. For example, France, Uganda.
      type: String
    - contextPath: Okta.Logs.Events.request.ipChain.source
      description: Details regarding the source.
      type: String
    - contextPath: Okta.Logs.Events.target.id
      description: ID of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.type
      description: Type of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.alternateId
      description: Alternative ID of a target.
      type: String
    - contextPath: Okta.Logs.Events.target.displayName
      description: Display name of a target.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncout: true
tests:
- Okta IAM - Test Playbook
defaultmapperin: Okta IAM - App Sync (mapper)
defaultclassifier: Okta IAM - App Sync (classifier)
fromversion: 6.0.0