Collect Okta logs

This document explains how to ingest Okta logs to Google Security Operations using the Okta API. The parser extracts system logs, handling both single events and batched events within a JSON array. It normalizes the data into the UDM format, mapping Okta fields to UDM equivalents, enriching the data with parsed user agents, geographical information, and authentication details, and generating security result events based on outcomes and risk information.

Before you begin

• Google SecOps instance
• Privileged access to Okta

How to configure Okta

To configure Okta SSO, complete the following tasks:

Create Okta Administrative user with read-only privileges

1. Sign in to the Okta administrator console.

2. Create a Standard User.

   • Go to Directory > People.
   • Click Add person and complete the required fields.

3. Select Security > Administrators.

4. Click Add Administrator.

5. In the Administrator assignment by admin field, find the Standard User.

6. In the roles section, select Read-Only Administrator from the list.

7. Sign out from the administrator account.

Get API key

1. Sign in to the Okta Administrator Console with the read-only administrator user.
2. Go to Security > API > Tokens.
3. Click Create Token.
4. Provide a meaningful name for the token.
5. Provide the IP zone, where the API will be used (you can select any IP if you are not sure).
6. Click Create Token.
7. Copy the API key.
8. Click OK, got it.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the Okta feed

To configure this log type, follow these steps:

1. Click the Okta pack.
2. Locate the Okta logtype.

3. Specify values for the following fields:

   • Source Type: Third party API (recommended)
   • Authentication HTTP header: Enter Okta API Key in the following format: Authorization:<API_KEY>.
   • API Hostname: Specify the domain name of your Okta host (for example, <your-domain>.okta.com).
   • Asset namespace: The asset namespace.
   • Ingestion labels: The label applied to the events from this feed.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create Feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

UDM mapping table

Array mapping table

The following table lists the mapping of Okta array elements to repeated UDM fields.

UDM mapping delta reference

On August 26, 2025, Google SecOps released a new version of the Okta parser, which includes significant changes to the mapping of Okta log fields to UDM fields and changes to the mapping of event types.

Log-field mapping delta

The following table lists the mapping delta for Okta log-to-UDM fields exposed prior to August 26, 2025 and subsequently (listed in the Old mapping and Current mapping columns respectively).

Event-type mapping delta

Multiple events that were classified before as generic event are now properly classified with meaningful event types.

The following table lists the delta for the handling of Okta event types prior to August 26, 2025 and subsequently (listed in the Old event_type and Current event-type columns respectively).

Need more help? Get answers from Community members and Google SecOps professionals.