Okta Detections and Queries

Integration

Panther supports Okta System Log as a native API puller. See the onboarding guide here.
The Okta System Log schema can be found under Analysis -> Schema within the Panther UI or from the Panther Analysis repository on Github.

Native Detections

Panther has a number of detections specifically for Okta. These can all be found within the Panther Analysis repository on Github.

Okta Admin Role Assigned - A user has been granted administrative privileges in Okta=

Okta API Key Created - A user created an API Key in Okta

Okta API Key Revoked - A user has revoked an API Key in Okta

Geographically Improbable Okta Login - A user has subsequent logins from two geographic locations that are very far apart

Have other Okta detections that can be used by other customers? Consider sharing detections back to the Panther Analysis repository or work with your Customer Success team!

Custom Detections

Suspicious Behavior Reported

Description: A user has reported suspicious behavior from their account
1
def rule(event):
2
if event.get('eventtype') == 'user.account.report_suspicious_activity_by_enduser':
3
return True
Copied!
Below are some common functions and example deep_get() uses when writing custom detections for Okta. Explanations on different event types can be found in the Okta documentation.
1
#Okta has many event types that are listed here. You can begin your detection based on one of these eventtypes
2
#https://developer.okta.com/docs/reference/api/event-types/
3
event.get('eventtype')
4
5
#To access the city, state, lat, lon etc.
6
deep_get(event, 'client', 'geographicalContext', 'city')
7
deep_get(event, 'client', 'geographicalContext', 'state')
8
deep_get(event, 'client', 'geographicalContext', 'country')
9
deep_get(event, 'client', 'geographicalContext', 'geolocation', 'lon')
10
deep_get(event, 'client', 'geographicalContext', 'geolocation', 'lat')
11
12
#Details on the source of the event
13
deep_get(event, 'client' 'device')
14
deep_get(event, 'client', 'ipAddress')
15
deep_get(event, 'client', 'userAgent')
16
17
18
deep_get(event, 'actor', 'alternateId')
19
deep_get(event, 'actor', 'displayName')
20
21
## Global helpers that may be useful with Okta
22
23
# within panther_base_helpers
24
def okta_alert_context(event: dict):
25
"""Returns common context for automation of Okta alerts"""
26
return {
27
"ips": event.get("p_any_ip_addresses", []),
28
"actor": event.get("actor", ""),
29
"target": event.get("target", ""),
30
"client": event.get("client", ""),
31
}
32
33
# within panther_base_helpers
34
def is_ip_in_network(ip_addr, networks):
35
"""Check that a given IP is within a list of IP ranges"""
36
return any(ip_address(ip_addr) in ip_network(network) for network in networks)
Copied!

Queries

Below are a few queries to get started with investigating and learning your Okta events. These queries are written for Snowflake SQL syntax.

Top logins by user last 7 days

1
-- Top logins by user last 7 days
2
SELECT actor:alternateId as actor, COUNT(*) as total
3
FROM panther_logs.public.okta_systemlog
4
WHERE eventtype = 'user.authentication.sso'
5
and outcome:result = 'SUCCESS'
6
and p_occurs_since(7d)
7
GROUP BY actor
8
ORDER BY total desc
Copied!

Logins by hour last 1 day

1
-- Logins by hour last 1 day
2
SELECT
3
time_slice(p_event_time, 1, 'HOUR', 'START') as "start",
4
time_slice(p_event_time, 1, 'HOUR', 'END') as "end",
5
count(*) as "logins",
6
count(distinct(actor:alternateId)) as "users"
7
FROM panther_logs.public.okta_systemlog
8
WHERE eventtype = 'user.authentication.sso'
9
and outcome:result = 'SUCCESS'
10
and p_occurs_since(1d)
11
GROUP BY "start", "end"
12
ORDER BY "start" desc
Copied!

Top applications last 7 days

1
-- Top applications last 7 days
2
SELECT GET(target, 0):displayName as application, count(*) as total
3
FROM panther_logs.public.okta_systemlog
4
WHERE eventtype = 'user.authentication.sso'
5
and p_occurs_since(7d)
6
GROUP BY Application
7
ORDER BY total desc
Copied!

Top failing users last 7 days

1
-- Top failing users last 7 days
2
SELECT actor:alternateId as actor, COUNT(*) as total
3
FROM panther_logs.public.okta_systemlog
4
WHERE eventtype = 'user.session.start'
5
and outcome:result = 'FAILURE'
6
and outcome:reason = 'INVALID_CREDENTIALS'
7
and p_occurs_since(7d)
8
GROUP BY actor
9
ORDER BY total desc
Copied!

Login failures by reason last 7 days

1
-- Login failures by reason
2
SELECT outcome:reason as reason, COUNT(*) as total
3
FROM panther_logs.public.okta_systemlog
4
WHERE eventtype = 'user.session.start'
5
and outcome:result = 'FAILURE'
6
and p_occurs_since(7d)
7
GROUP BY reason
8
ORDER BY total desc
Copied!

Fake account login attempts last 7 days

1
-- Fake account login attempts
2
SELECT actor:alternateId as actor, COUNT(*) as total
3
FROM panther_logs.public.okta_systemlog
4
WHERE eventtype = 'user.session.start' and
5
outcome:result = 'FAILURE' and
6
outcome:reason = 'VERIFICATION_ERROR'
7
GROUP BY actor
8
ORDER BY total desc
Copied!
Last modified 2mo ago