TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: API Log Source
ENVIRONMENT: Okta System Log
SUMMARY: Configuration Guide for Okta System Log Ingestion
AVAILABILITY:  General Availability

Vendor Information

Source Configuration

Configure Okta API Access

To successfully integrate the Huntress Managed SIEM with Okta System Log, an API token with the following minimum permissions is required:

• Read-Only Administrator (or Super Administrator)

To acquire an API token, follow these steps:

1. Sign in to the Okta Admin Console.
2. Navigate to Security > API > Tokens.
3. Click Create Token.
4. Enter a descriptive name (e.g. Huntress SIEM) and click Create Token.
5. Copy the token value — it is only shown once.
6. Note your Okta domain from the browser address bar (e.g. yourcompany.okta.com).

Note: Custom-branded Okta domains (e.g. sso.yourcompany.com) are not currently supported. The domain must end in .okta.com or .oktapreview.com.

Create the Huntress SIEM Integration

1. Navigate to Huntress SIEM > Source Management.
2. Select the green +Add button to create a new Okta System Log configuration.
   

3. Enter the configuration details:

   1. Select the appropriate Organization from the drop-down menu.
   2. Enter a unique Name for the source.
   3. Enter the Okta Domain (e.g. yourcompany.okta.com).
   4. Enter the API Token from Step 5 above.

   

4. Select Save.