Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Current »

About The Device

OKTA Identity Engine:

Okta is an on-demand identity and access management service that enables enterprises to accelerate the secure adoption of their web-based applications, both in the cloud and behind the firewall. With Okta, IT can manage an employee's access to any application or device.

OKTA Advanced Server Access (ASA):

Okta Advanced Server Access provides Zero Trust identity and access management for cloud and on-premises infrastructure. Advanced Server Access extends secure privileged access to users, automates lifecycle management for server accounts, and eliminates the need for credential management.

Device Information

 Entity

Particulars

Vendor Name

Okta

Product Name

Identity Engine (Previously known as SSO)

Type of Device

Cloud

Collection Method

Log Type

 Ingestion label

Preferred Logging Protocol

Log Collection Method

Data Source

Okta

 OKTA

JSON

C2C

https://cloud.google.com/chronicle/docs/reference/feed-management-api#okta

Device Configuration

Read-Only Admin User creation:

  1. Login to OKTA SSO Admin Console with an Admin user.

  2. Create a standard user or if you already have a user you want to make read-only admin go to next section.

  3. Navigate to Security > Administrators

image-20240111-055116-20240402-095150.png

  1. Click Add Administrator

image-20240111-055202-20240402-095151.png

  1. Grant administrator role to the user you previously created and in Administrator roles select Read Only Administrator

image-20240111-055250-20240402-095153.png

  1. Logout from a current admin account.

To Get API key

  1. Sign in to the OKTA SSO Admin console with the Read-only admin user created above

  2. Click Security, and select API

image-20240111-055419.png

  1. Click Create Token

image-20240111-055459.png

  1. Give the token a name and click Create Token

image-20240111-055545.png

  1. A token value will be generated, this is the API key. Copy the API key, which is required when you configure the Chronicle feed.

image-20240111-055634-20240402-095148.png

  1. Click OK, got it.

  1. We get only one chance to copy the token when creating it, after that it gets stored in encrypted format.

  2. The token will remain valid as long as the user who created it exists and has the same privileges. Any change to this user or its privileges may lead to token not functioning and hence broken integration.

  3. If the token is revoked or gets expired because of not being used, log collection will stop and a new token will be required when you configure the Chronicle feed.

Log Collection steps for Okta Advanced Server Access (ASA)  -

Okta Advanced Server Access (ASA) audit events can be fetched through Okta System Log API. To enable this, Okta ASA Audit events integration should be done with Okta System Log. 

This is an Early Access Feature as of now. To enable it, customer needs to connect with OKTA support. Please follow this link for your reference. 
https://help.okta.com/asa/en-us/Content/Topics/Adv_Server_Access/docs/audit-events-with-okta-syslog.ht

Integration Parameters

Parameters required from customer for Integration.

Property

Default Value

Description

AUTHENTICATION HTTP HEADERS

N/A

The HTTP header used to authenticate Okta in key-value format. E.g. - Authorization:<API Key>

API HOSTNAME

N/A

The fully qualified domain name of your Okta instance. E.g. - xxxx.okta.com

 

  • No labels

About Accenture:
Accenture is a leading global professional services company that helps the world’s leading businesses, governments and other organizations build their digital core, optimize their operations, accelerate revenue growth and enhance citizen services—creating tangible value at speed and scale. We are a talent and innovation led company with 738,000 people serving clients in more than 120 countries. Technology is at the core of change today, and we are one of the world’s leaders in helping drive that change, with strong ecosystem relationships. We combine our strength in technology with unmatched industry experience, functional expertise and global delivery capability. We are uniquely able to deliver tangible outcomes because of our broad range of services, solutions and assets across Strategy & Consulting, Technology, Operations, Industry X and Accenture Song. These capabilities, together with our culture of shared success and commitment to creating 360° value, enable us to help our clients succeed and build trusted, lasting relationships. We measure our success by the 360° value we create for our clients, each other, our shareholders, partners and communities. Visit us at www.accenture.com.

About Accenture Security
Accenture Security is a leading provider of end-to-end cybersecurity services, including advanced cyber defense, applied cybersecurity solutions and managed security operations. We bring security innovation, coupled with global scale and a worldwide delivery capability through our network of Advanced Technology and Intelligent Operations centers. Helped by our team of highly skilled professionals, we enable clients to innovate safely, build cyber resilience and grow with confidence. Follow us @AccentureSecure on Twitter or visit us at www.accenture.com/security.

Legal notice: Accenture, the Accenture logo, and other trademarks, service marks, and designs are registered or unregistered trademarks of Accenture and its subsidiaries in the United States and in foreign countries. All trademarks are properties of their respective owners. This document is intended for general informational purposes only and does not take into account the reader’s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this presentation and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professionals.