OKTA Single Sign-On

OverviewResources

Once logs are received in to EventTracker, reports and alerts can be configured into EventTracker.
The following Knowledge Packs are available in EventTracker v9 and later to support Okta SSO monitoring:

Compliance

Reports

OKTA SSO - System events: This report provides information related to system activities which is happening in OKTA SSO cloud.
OKTA SSO - Application changes: This report provides information related to changes in application which is integrated with OKTA.
OKTA SSO - User management: This report provides information related to changes (user added, deleted, modified, added into group, removed from groups, etc).
OKTA SSO - User session details: This report provides information related to user login activities in mobile or application.

Operations

Reports

OKTA SSO-Application membership changes: This report provides information related to changes in OKTA SSO apps membership. This report contains activities like app added/removed from Application group.
OKTA SSO-Policy changes: This report provides information related to changes (policy added, deleted or modified) in OKTA SSO policy.

Security

Alerts

OKTA SSO – User Login failed: This alert will be triggered when a user attempt to login but fails. This will help us to find the unauthorized access.

Reports

OKTA SSO - User authentication details: This report provides information related to authentication attempt (failure as well as success) made by user.
OKTA SSO - Admin access: This report provides information when user is trying to access admin console of OKTA SSO.

Scope

The configuration details in this guide are consistent with EventTracker version 9.X and later, Okta SSO.

Documentation:

For more information please refer to the Integration Guide.