{ "name": "okta", "title": "Okta", "version": "3.5.1", "release": "ga", "description": "Collect and parse event logs from Okta API with Elastic Agent.", "type": "integration", "download": "/epr/okta/okta-3.5.1.zip", "path": "/package/okta/3.5.1", "icons": [ { "src": "/img/okta-logo.svg", "path": "/package/okta/3.5.1/img/okta-logo.svg", "title": "Okta", "size": "216x216", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "iam" ], "signature_path": "/epr/okta/okta-3.5.1.zip.sig", "format_version": "3.2.3", "readme": "/package/okta/3.5.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/filebeat-okta-dashboard.png", "path": "/package/okta/3.5.1/img/filebeat-okta-dashboard.png", "title": "Okta Dashboard", "size": "1024x662", "type": "image/png" } ], "assets": [ "/package/okta/3.5.1/LICENSE.txt", "/package/okta/3.5.1/changelog.yml", "/package/okta/3.5.1/manifest.yml", "/package/okta/3.5.1/validation.yml", "/package/okta/3.5.1/docs/README.md", "/package/okta/3.5.1/img/filebeat-okta-dashboard.png", "/package/okta/3.5.1/img/okta-logo.svg", "/package/okta/3.5.1/kibana/tags.yml", "/package/okta/3.5.1/data_stream/system/manifest.yml", "/package/okta/3.5.1/data_stream/system/sample_event.json", "/package/okta/3.5.1/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json", "/package/okta/3.5.1/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json", "/package/okta/3.5.1/data_stream/system/fields/agent.yml", "/package/okta/3.5.1/data_stream/system/fields/base-fields.yml", "/package/okta/3.5.1/data_stream/system/fields/beats.yml", "/package/okta/3.5.1/data_stream/system/fields/fields.yml", "/package/okta/3.5.1/data_stream/system/agent/stream/httpjson.yml.hbs", "/package/okta/3.5.1/data_stream/system/elasticsearch/ingest_pipeline/default.yml", "/package/okta/3.5.1/data_stream/system/elasticsearch/ingest_pipeline/no_use_flattened_debug.yml", "/package/okta/3.5.1/data_stream/system/elasticsearch/ingest_pipeline/use_flattened_debug.yml" ], "policy_templates": [ { "name": "okta", "title": "Okta logs", "description": "Collect logs from Okta", "inputs": [ { "type": "httpjson", "vars": [ { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which logs are pulled. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "Initial Interval for first log pull. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "url", "type": "text", "title": "Okta System Log API URL", "description": "This is the URL of your Okta System Log API. For example, https://dev-123456.okta.com/api/v1/logs.", "multi": false, "required": true, "show_user": true }, { "name": "api_key", "type": "password", "title": "API Key", "description": "This is the API Key of your Okta service application. This is required for standard api key based authentication and Okta Integration Network (OIN) app authentication.\nDo not use this field if you are using standard OAuth2 authentication.\n", "multi": false, "required": false, "show_user": true }, { "name": "oin_app", "type": "bool", "title": "Use Okta Integration Network (OIN) Authentication", "description": "Use the API Key as the OIN client secret.", "multi": false, "required": false, "show_user": true }, { "name": "okta_domain_url", "type": "text", "title": "Okta Domain URL", "description": "This is the URL of your Okta domain. For example, https://dev-123456.okta.com.\nThis is only required for OAuth2 authentication. This is required for standard OAuth2 authentication and OIN app authentication.\nDo not use this field if you are using API Key based authentication without OIN authentication.\n", "multi": false, "required": false, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "This is the Client ID of your Okta service application. This is required for standard OAuth2 authentication and OIN app authentication.\nDo not use this field if you are using API Key based authentication without OIN authentication.\n", "multi": false, "required": false, "show_user": true }, { "name": "jwk_json", "type": "password", "title": "JWK JSON", "description": "This is the private JSON Web Key (JWK) of your Okta service application.\nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\nOnly one of JWK JSON, PEM Encoded Key or JWK File may be used.\n", "multi": false, "required": false, "show_user": true }, { "name": "key_pem", "type": "textarea", "title": "PEM Encoded Key", "description": "This is the private key of your Okta service application in PEM format.\nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\nOnly one of JWK JSON, PEM Encoded Key or JWK File may be used.\n", "multi": false, "required": false, "show_user": true }, { "name": "jwk_file", "type": "text", "title": "JWK File", "description": "This is the path to the file containing the private JSON Web Key (JWK) of your Okta service application.\nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\nOnly one of JWK JSON, PEM Encoded Key or JWK File may be used.\n", "multi": false, "required": false, "show_user": true }, { "name": "okta_scopes", "type": "text", "title": "Okta Scopes", "description": "This is the list of 'okta.*' scopes that your Okta service application has access to.\nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\n", "multi": true, "required": false, "show_user": true, "default": [ "okta.logs.read" ] }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false } ], "title": "Collect Okta logs via API", "description": "Collecting logs from Okta via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "okta.system", "title": "Okta system logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "okta-system" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "remove_flattened_debug", "type": "bool", "title": "Remove flattened debug data", "description": "When set to false, the original `debugContext.debugData` object will be kept in `okta.debug_context.debug_data.flattened`. We recommend turning this on for new installations where nothing depends on `okta.debug_context.debug_data.flattened`.", "multi": false, "required": false, "show_user": false }, { "name": "disable_keep_alive", "type": "bool", "title": "Disable HTTP Keep-Alives", "description": "Controls whether HTTP keep-alives are disabled.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Okta system logs", "description": "Collect Okta system logs", "enabled": true, "ingestion_method": "API" } ], "package": "okta", "path": "system" } ] }