> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/integrations/okta-workflows.md). # Okta Workflows 02/2024 Fetch end user information and react to Identity Intelligence threat detection with Cisco Identity Intelligence. ## Authorization ### Prerequisites Generate client API credentials in Cisco Identity Intelligence or the Cisco Cloud Control Identity app: 1. From the Integrations tab, click **Add Integration**. 2. Scroll down and click **Add API Client**. 3. Provide a **Name** and **Description**. 4. Click **Save and generate credentials**. 5. Click **Copy all** to copy the credentials to your clipboard. ### Create a connection When you add a Cisco Identity Intelligence card to a flow for the first time, you'll be prompted to configure a connection. You can reuse the connection for future flows. Starting with version 61 of the connector, choose the **Auth Scheme** that matches your account: **Identity Intelligence** is the legacy connection for Cisco Identity Intelligence users, and **Identity Fabric** is for Cisco Cloud Control users. To create a new connection from an Action card: 1. Click **New Connection**. 2. Enter a **Name** and, if helpful, a **Description**. Use a name that distinguishes this connection if you create more than one. 3. Select **Identity Intelligence** or **Identity Fabric** from **Auth Scheme**. 4. Enter the values for the selected scheme as described below. #### Identity Intelligence (legacy) | Field | Value | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Client ID** | Copy this value from your Cisco Identity Intelligence API client details. | | **Client Secret** | Copy this value from your Cisco Identity Intelligence API client details. | | **Token Subdomain** | From the **tokenUrl** value in the API client details, enter the part of the hostname before `.oort.io`. For example, if the token URL is `https://login.eu.oort.io/oauth/token`, enter `login.eu`. | | **API URL** | Copy this value from your Cisco Identity Intelligence API client details. | #### Cisco Cloud Control (Identity Fabric) | Field | Value | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Client ID** | Copy this value from the Cisco Cloud Control Identity app **API Client** page. | | **Client Secret** | Copy this value from the Cisco Cloud Control Identity app **API Client** page. | | **Token Sub Domain** | From the token URL, enter the part of the hostname before `.sso.duosecurity.com`. For example, if the token URL is `https://sso-abcd1234.sso.duosecurity.com/oauth/EFGH5678/token`, enter `sso-abcd1234`. | | **Token App ID** | From the same token URL, enter the value between `/oauth/` and `/token`. In the example above, enter `EFGH5678`. | | **API URL** | Copy this value from the Cisco Cloud Control Identity app **API Client** page. | After entering the values for your Auth Scheme, click **Create**. ## Connector cards ### Cisco Identity Intelligence event cards | Event | Description | | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | [Identity Intelligence Webhook](#identity-intelligence-webhook) | Triggers a flow when a specific check has new users failing the check in Cisco Identity Intelligence. | ### Cisco Identity Intelligence action cards | Action | Description | | ------------------------------------------- | ------------------------------------------------------------------------------------------- | | [Get End User State](#get-end-user-state) | Fetch a concise summary of end-user information, including key fields and relevant details. | | [Get End Users By IP](#get-end-users-by-ip) | Retrieve users associated with a specified IP address. | ## Events ### Identity Intelligence Webhook Triggers a flow when a user is failing the check in Cisco Identity Intelligence. #### Options | Field | Definition | Type | Required | | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | -------- | | Shared Secret | A secret string for verifying the source of webhooks. It is sent by Cisco Identity Intelligence events in a header named "x-api-client-token" in the webhook payload | Text | TRUE | | Check ID | A Cisco Identity Intelligence check ID to send events from to the webhook. This can be later updated in the Cisco Identity Intelligence dashboard. | Text | FALSE | #### Output | Field | Definition | Type | | ------------------------- | ------------------------------------------------------------------------------------------------------------ | --------------- | | `detail` | Webhook payload. | Object | | ➥ `id` | The the event ID | Text | | ➥ `checkId` | The ID of the failed check in the Cisco Identity Intelligence that triggered the event | Text | | ➥ `title` | The check title. | Text | | ➥ `severity` | The check severity in Cisco Identity Intelligence. | Text | | ➥ `login` | The login identifier of the failing user | Text | | ➥ `explainabilityDetails` | List of objects of type `{"key":, "value":}` with explainability details about the failing check | List of Objects | | ➥ `checkTopics` | List of topic the check relates to (e.g. `Compliance`, `Devices`) | List of Text | | ➥ `checkTags` | List of tags applied to the check | List of Text | | ➥ `frameworks` | List of frameworks the check is a part of (e.g. `NIST`, `MITRE`) | List of Text | | ➥ `published` | Timestamp the payload was generated. | Date & Time | | `region` | The Cisco Identity Intelligence deployment region from which the event originated | Text | | `id` | The webhook event ID | Text | | `time` | The Date/Time the event was triggered | Text | | `detail-type` | Type of content in the event | Text | | `source` | Identifier of the Identity Intelligence instance | Text | ## Actions ### Get End User State Fetch a concise summary of end-user information, including key fields and relevant details. #### Input | Field | Definition | Type | Required | | ----- | --------------------- | ---- | -------- | | Login | User's email address. | Text | TRUE | #### Output | Field | Definition | Type | | --------------------------- | --------------------------------------------------------------------------------- | --------------- | | `Status Code` | HTTP response code. | Number | | | | | | `EndUser State` | Summary of end-user information. | Object | | `id` | The user ID in Cisco Identity Intelligence. | Text | | `displayName` | The user's display name. | Text | | `login` | User's email address. | Text | | `employeeID` | The user ID Employee ID in the Identity Provider or HR system. | Text | | `status` | The aggregated user status in the identity providers. | Text | | `userTypeClassification` | The user classification in Cisco Identity Intelligence | Text | | `managerLogin` | User's manager email address. | Text | | `ipAddresses` | List of IP Addresses used by the user. | List of Objects | | ➥ `ipAddress` | IP Address used by the user. | Text | | ➥ `location.city` | IP Geolocation city of the IP Address. | Text | | ➥ `location.state` | IP Geolocation state of the IP Address. | Text | | ➥ `location.country` | IP Geolocation country of the IP Address. | Text | | `phoneNumber` | User's phone number. | Text | | `unusedApplications` | Names of applications the user has access and did not access in the past 30 days. | List of Text | | `usedApplications` | Names of applications the user has access and accessed in the past 30 days. | List of Text | | `usedFactors` | Authentication factors used by the user. | List of Text | | `referenceUrl` | User's URL in Cisco Identity Intelligence. | Text | | `registeredLocationDetails` | The user's registered location | Object | | ➥ `city` | The registered location city. | Text | | ➥ `state` | The registered location state. | Text | | ➥ `country` | The registered location country. | Text | | `workingLocationDetails` | List of the locations the user works in. | List of Object | | ➥ `userLocationPrevalence` | The prevalence of the working location for the user, as a percentage. | Number | | ➥ `location.city` | The working location city. | Text | | ➥ `location.state` | The working location state. | Text | | ➥ `location.country` | The working location country. | Text | | | | | | `Errors` | List of errors that might have occurred in the request. | List of Object | | `path` | Paths that had errors in the request. | List of Text | | `errorType` | Type of the error. | Text | | `message` | Error message. | Text | | `errorInfo` | Information about the error | List of Object | | `data` | Data about the error | List of Object | ### Get End Users By IP Retrieve users associated with a specified IP address. #### Input | Field | Definition | Type | Required | | ---------- | ----------- | ---- | -------- | | IP Address | IP Address. | Text | TRUE | #### Output | Field | Definition | Type | | --------------- | -------------------------------------------------------------- | -------------- | | `Status Code` | HTTP response code. | Number | | | | | | `End Users IPs` | Itemized list of Users associated with a specified IP address. | Object | | `id` | The user ID in Cisco Identity Intelligence. | Text | | `displayName` | The user display name in Cisco Identity Intelligence | Text | | `login` | User's email address. | Text | | `referenceURL` | User's URL in Cisco Identity Intelligence. | Text | | | | | | `Errors` | List of errors that might have occurred in the request. | List of Object | | `path` | Paths that had errors in the request. | List of Text | | `errorType` | Type of the error. | Text | | `message` | Error message. | Text | | `errorInfo` | Information about the error | List of Object | | `data` | Data about the error | List of Object |