Skip to main content

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure the Okta Cloud Collector

Before you configure the Okta Cloud Collector, complete the following prerequisites:

  • Obtain your organization's Okta URL.

  • Obtain the Okta API token.

  • Add an Okta account.

  • Ensure that the administrator has the Read-Only Admin role with the System Logs permission. For more information, see System Logs in Okta documentation.

Obtain an API Token

Okta APIs are authenticated via application keys. You must obtain the API key or token that you can use while configuring the Okta Cloud Collector.

To obtain an API token:

  1. Create an Okta account with a user role Read-Only Administrator.

  2. Log in to the Okta administrator console as an administrator with Read-Only Administrator role.

  3. Navigate to Security > API > Tokens.

  4. Click Create Token.

  5. Enter the name for the token, then click Create Token. Note the value represented by a string of letters and numbers, to use while configuring the Okta cloud connector. For more information, see the Okta Documentation.

Add Accounts for Okta Cloud Collectors

For ease of setup, you can use your Okta account across one or more Okta Cloud Collectors.

To set up a shareable Okta account in Cloud Collectors:

  1. Log in to the Exabeam Security Operations Platform with your registered credentials as an administrator.

  2. Navigate to Collectors > Cloud Collectors.

  3. Click Accounts, then click New Account.

    Okta_Account1.png

  4. In the Add a New Account page, enter the required information.

    Okta_Add_Accounts.png

    • VENDOR – Select the vendor as Okta.

    • NAME – Specify a name for the Okta account.

    • URL – Enter the Okta account URL. For example, https://mycompanyokta.okta.com.

    • API-TOKEN – Enter the value API token that you obtained while completing the prerequisites for the cloud collector you want to configure: Okta Cloud Collector or Okta Context Cloud Collector.

  5. Click Save.

  6. Proceed to configure your Okta Cloud Collector or Okta Context Cloud Collector.

    When you onboard new collectors for Okta, you must select the Okta account. You can reuse credentials between different Okta collectors provided that you have the required permissions configured for the collector.

Supported Event Types

The following table displays the security event types supported by Okta Cloud Collector.

API Resource

Supported Event Types

System Log

Session - start / end / clear

Access Admin App

Password - reset / update

Account - lock / unlock

User - create / suspend / unsuspend / activate / deactivate / delete

Events

Authentication - SSO / MFA

Token - create / revoke

Group membership - add / remove

Application assignment - add / remove

User membership - add / remove / update

Application - update / delete / activate / deactivate

Zone - create / update / delete

Password policy rule - create / update / override / delete / activate / deactivate