Copy page

Okta

System Audit Logs

Ingests Okta system events for audit trail analysis and platform activity monitoring.

Sync Type: Incremental

Authentication

This input supports API Key and OAuth 2.0 (service app) authentication. See Okta Authentication for setup instructions and required credentials for each method.

Details

Monad keeps track of the state of the Input via a timestamp by using the the since filter parameter on the api. We use the timestamp of the last successful run to retrieve only newer logs that have appeared between the current and last successful runs of this Input. Monad Generates a timestamp when initiating the sync. It will only save the timestamp if no errors occur during the sync.

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

Setting	Type	Required	Description
Org URL	string	Yes	Your Okta Organization URL.
Backfill Start Time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.
API Rate Limit	object	No	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.

Secrets

Secrets vary by authentication method. See Okta Authentication for details. If using the Oauth flow, the token should be granted the okta.logs.read scope.

OCSF Conversion

The following JQ transformation converts Okta System Log data to OCSF Version 1.1.0 compliant format.

Related Articles

• https://help.okta.com/en-us/content/topics/security/api.htm
• https://developer.okta.com/docs/reference/api/system-log/

Sample Record

Code
{
  "actor": {
    "id": "00u5syyx5nWoMofVG697",
    "type": "User",
    "alternateId": "carol.brown@example.com",
    "displayName": "Peter Williams",
    "detailEntry": null
  },
  "client": {
    "userAgent": {
      "rawUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537",
      "os": "Windows 10",
      "browser": "CHROME"
    },
    "zone": "zone1",
    "device": "Computer",
    "id": null,
    "ipAddress": "122.81.138.43",
    "geographicalContext": {
      "city": "Los Angeles",
      "state": "California",
      "country": "United States",
      "postalCode": "90001",
      "geolocation": {
        "lat": 34.0522,
        "lon": -118.2437
      }
    }
  },
  "device": null,
  "authenticationContext": {
    "authenticationProvider": null,
    "credentialProvider": null,
    "credentialType": null,
    "issuer": null,
    "interface": null,
    "authenticationStep": 0,
    "externalSessionId": "102iMPbbG5LQWie2hixFENZjA"
  },
  "displayMessage": "User accessing Okta admin app",
  "eventType": "user.session.access_admin_app",
  "outcome": {
    "result": "SUCCESS",
    "reason": null
  },
  "published": "2025-08-11T23:46:52.179765Z",
  "securityContext": {
    "asNumber": 7922,
    "asOrg": "comcast",
    "isp": "comcast",
    "domain": "comcast.net",
    "isProxy": false
  },
  "severity": "INFO",
  "debugContext": {
    "debugData": {
      "requestId": "43ac7e83fe4db209cde65a60660d0de4",
      "dtHash": "9d7615ea3e9691b91a63e1afe174d601aa4629a3634545dc54c80b86b4ac80fc",
      "requestUri": "/admin/sso/callback",
      "threatSuspected": "false",
      "url": "/admin/sso/callback?code=******&state=PL-xCLrZqA-VcVgCQeTfunyoliTaqrui"
    }
  },
  "legacyEventType": "app.admin.sso.login.success",
  "transaction": {
    "type": "WEB",
    "id": "43ac7e83fe4db209cde65a60660d0de4",
    "detail": {}
  },
  "uuid": "dbbb906c-b195-11ee-8a84-b58212db54c8",
  "version": "0",
  "request": {
    "ipChain": [
      {
        "ip": "73.63.194.174",
        "geographicalContext": {
          "city": "Los Angeles",
          "state": "California",
          "country": "United States",
          "postalCode": "90001",
          "geolocation": {
            "lat": 34.0522,
            "lon": -118.2437
          }
        },
        "version": "V4",
        "source": null
      }
    ]
  },
  "target": [
    {
      "id": "00u5syyx5nWoMofVG697",
      "type": "AppUser",
      "alternateId": "",
      "displayName": "Jane Johnson",
      "detailEntry": null
    }
  ]
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.