OKTA

Okta is a cloud-based identity and access management (IAM) platform that provides centralized authentication, authorization, single sign-on (SSO), multi-factor authentication (MFA), and user lifecycle management for organizations. This data integration enables comprehensive querying and monitoring of Okta's identity infrastructure, user access controls, security policies, and application integrations.

Category	Identity
Direction	Query source
Sign-in	API Token, OAuth Client Credentials (Private Key)
Query languages	SQLite, STIX
Tables	19
Query templates	73
Website	okta.com

Before you start

Huntbase can sign in to OKTA with any of these methods: API Token, OAuth Client Credentials (Private Key). Pick one, create the credential in OKTA, then keep it to hand for the Connect step.

API Token

Okta API token (SSWS) used for authentication.

1. Sign in to the Okta Admin Console as the admin whose permissions the token should have. Use a dedicated read-only admin service account when you can.
2. Go to Security › API, click the Tokens tab, and click Create token.
3. Enter a name, choose where API calls may originate from, and click Create token.
4. Copy the token value. This is the only time it is shown.

Permissions:

• The token inherits the permissions of the admin who created it. Read-only admins can create tokens.

OAuth Client Credentials (Private Key)

Okta application using the client credentials flow with a private key (PrivateKey OAuth auth mode).

1. In the Admin Console, go to Applications and Resources › Applications, click Create App Integration, choose API Services, and save the app.
2. On the General tab, under Client Credentials, click Edit and choose Public key/Private key as the client authentication method.
3. Click Add key, then Generate new key, click PEM, and copy the private key.
4. On the Okta API Scopes tab, click Grant for each scope listed below.
5. On the Admin Roles tab, click Edit assignments, choose a role, and click Save Changes. Copy the app's Client ID.

Permissions:

• okta.users.read
• okta.groups.read
• okta.apps.read
• okta.devices.read
• okta.roles.read
• okta.policies.read
• okta.authorizationServers.read
• okta.trustedOrigins.read
• okta.factors.read
• okta.authenticators.read

Watch out for

• An API token that isn't used for 30 days expires. Each API call resets the 30-day window.
• User types and network zones can't be queried with the OAuth (service app) method.

For the vendor's own instructions, see Okta API token documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect OKTA

1. Go to Connections and click New connection, or click New connection on the OKTA product page.
2. On Product, pick OKTA and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your OKTA lives:

Field	Required	Notes
Okta Domain (Org URL)	Yes	Your org URL, such as https://<your_okta_domain>.okta.com.
Client ID	No
Max Retries	No
Max Backoff (seconds)	No
Request Timeout (seconds)	No
Server Address	Yes	Specify the IP address or hostname of the data source.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

API Token

Field	Required	Notes
API Token	Yes	Secret — not shown again after you save it.

OAuth Client Credentials (Private Key)

Field	Required	Notes
Private Key	Yes	The full PEM private key, including the -----BEGIN and -----END lines. Secret — not shown again after you save it.

Query it

Once connected, OKTA can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 19 tables listed below, alongside every other connected source.
STIX	STIX patterns for indicator sweeps, translated into the product's native search.

Example: SQLite

Get group member details for each group — Retrieve the members associated with each group within the organization.

select
  name,
  id,
  group_members
from
  okta_group;

OKTA ships with 73 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically

OKTA comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

Query	Finds
Sync users	user
Sync groups	group
Sync devices	device
Sync application user assignments	application, user
Sync application group assignments	application, group
Sync MFA policies	policy

Tables

OKTA adds 19 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 19 tables

Table	Contains
okta_app_assigned_group	Represents an application group assignment.
okta_app_assigned_user	Represents all assigned users for applications.
okta_application	An Application holds information about the protocol in which it wants Okta to communicate, policies for accessing the application, and which users can use the application after identifying themselves.
okta_auth_server	Represents an Okta Authorization Server.
okta_authentication_policy	Okta Authentication Policy controls the manner in which a user is authenticated, including MFA requirements.
okta_authenticator	Represents an Okta Authenticator configured in the organization.
okta_device	Okta’s device management is a crucial part of its broader suite of identity and access management solutions, helping organizations to secure their IT environments in an increasingly mobile and cloud-centric world.
okta_factor	Represents an Okta Factor.
okta_group	A Group is made up of users. Groups are useful for representing roles, relationships, and can even be used for subscription tiers.
okta_group_owner	An Okta Group owner is a designated individual responsible for managing and overseeing a specific group within the Okta identity and access management platform.
okta_group_rule	Retrieve group rules for Okta. Group rules define conditions and actions for automating group membership.
okta_idp_discovery_policy	The IdP Discovery Policy determines where to route Users when they are attempting to sign in to your org. Users can be routed to a variety of Identity Providers (SAML2, IWA, AgentlessDSSO, X509, FACEBOOK, GOOGLE, LINKEDIN, MICROSOFT, OIDC) based on multiple conditions.
okta_mfa_policy	The Multifactor (MFA) Enrollment Policy controls which MFA methods are available for a User, as well as when a User may enroll in a particular Factor.
okta_network_zone	The Okta Zones provides operations to manage Zones in your organization. There are two usage Zone types: Policy Network Zones and Block List Network Zones. Policy Network Zones are used to guide policy decisions. Block List Network Zones are used to deny access from certain IP addresses, locations, proxy types, or Autonomous System Numbers (ASNs) before policy evaluation.
okta_password_policy	The Password Policy determines the requirements for a user's password length and complexity, as well as the frequency with which a password must be changed. This Policy also governs the recovery operations that may be performed by the User, including change password, reset (forgot) password, and self-service password unlock.
okta_signon_policy	Okta Sign On Policy controls the manner in which a user is allowed to sign on to Okta, including whether they are challenged for multifactor authentication (MFA) and how long they are allowed to remain signed in before re-authenticating.
okta_trusted_origin	Trusted Origin is a security-based concept that combines the URI scheme, hostname, and port number of a page.
okta_user	Represents an Okta user account.
okta_user_type	Represents an Okta user account.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog