Okta Log Streaming AWS EventBridge Integration

03/2024

Overview

The Oort identity security platform integrates with Okta tenants to collect user account information, device information, and sign-on and application activity.

To enable hourly analysis of user activity and events, Oort can leverage Okta log streaming to an AWS EventBridge streaming model. Then the Oort platform can capture the events from the log stream.

NOTE:

  • By default, with event streaming enabled, the analysis of event-based detections will be performed hourly and associated notifications will be sent at that time.

  • Individual events for a user will be added to the user's Activity table once per day. To fetch the most recent events for a user, run the Refresh User Data action from the actions menu.

Prerequisites

You must already have an active Okta data integration in your Oort tenant that is connected via an Okta API token. Please see instructions here.

You must also have the Log Streaming module enabled for your tenant. Please see your Okta representative if you do not have this module as part of your current subscription.

Okta Log Streaming Configuration

For reference, the Okta log streaming documentation can be found here.

Permission requirements for setting up Oort integration with Okta

To add the necessary configuration in Okta, you need to be one of the following:

  • Read-only administrator

Setup Steps

There are 3 steps you need to go through to set up the AWS log streaming integration between Okta and Oort.

  1. In the Admin Console, go to Reports > Log Streaming. This page shows all of the log stream targets available in your org.

  2. Click Add Log Stream to start the log stream wizard.

  3. Select AWS EventBridge from the catalog. Click Next.

  4. Name: Provide a unique name for this log stream in Okta.

  5. AWS Event Source Name: The source name needs to be the Okta integration ID, which is available from the URL of the integration in the Oort console. Go to Integrations -> Edit Okta integration to see the URL. (screenshot above)

  6. AWS account ID: 909617834444 for Oort Staging 988897525199 for Oort Production

  7. AWS region: US East (Ohio)

  8. Click Save. You receive a confirmation message.

  9. Notify your Oort technical contact that the EventBridge is in place.

Last updated