Okta #

Log sources

  • Okta System Log - the single source of truth. API: /api/v1/logs. Each event has eventType, outcome.result, actor, client (geo, UA, device), authenticationContext, target[], debugContext.debugData. ts: published field - ISO-8601 UTC with ms (2026-01-14T13:22:14.173Z) stamped by Okta's backend when the event was processed. eventTime on some sub-objects may differ for events with a user-side time (e.g., device enrollment).
  • Retention - 90 days default; longer in Workflows / log streaming to S3 / Splunk / Sentinel. Many clients won't have anything beyond 90 - set expectation early. ts caveat: System Log API supports since/until in ISO-8601 UTC but returns max 1000 events per page; pagination is required for high-volume windows. Set sortOrder=ASCENDING and page with Link headers; otherwise you'll silently miss events.
  • Workflows execution history for automation changes. ts: each Workflow execution has startedAt, completedAt (UTC ms).
Okta IR tooling: Okta API (/api/v1/logs) via curl/okta-cli, Grimoire (Datadog SaaS IR, Okta investigation playbooks + fetch), Hawk (Okta module added), Okta IR Toolkit (community), Panther, Splunk Okta Identity Cloud add-on, Falcon Next-Gen SIEM Okta parser, har-sanitizer/okta-har-sanitizer before uploading HARs to Okta support.

High-value event types

eventTypeMeaning
user.session.startSuccessful auth
user.session.access_admin_appAdmin console access
user.account.update_password, user.mfa.factor.reset_all, user.mfa.factor.deactivate, user.mfa.factor.activateCredential & factor tampering - classic help-desk-reset abuse by Scattered Spider
user.authentication.sso + target appSSO handoff
system.api_token.create, .revokeAPI token lifecycle - attacker creates admin API token = persistent backdoor
user.account.privilege.grant, group.privilege.grantAdmin role grant
application.user_membership.add, application.lifecycle.createApp assignment / new malicious OIDC/SAML app
policy.rule.update, policy.evaluate_sign_onAuth policy weakening (MFA requirement removed, network zone added)
user.session.impersonation.initiate, …grant, …endSupport impersonation. 2023 Okta support HAR breach - audit these ruthlessly.
user.account.lock, unlockHelp-desk social eng indicator

Reference Okta incidents (scoping context)

  • Lapsus$ Sitel breach (Jan 2022) - third-party support engineer compromised; limited customer impact but massive brand damage. Chain-of-custody lesson.
  • Okta support case HAR file breach (Oct 2023) - HAR files uploaded to support contained session tokens; attackers (Scattered Spider / UNC3944) replayed into customer tenants. Lesson: sanitize HARs before upload - har-sanitizer, okta-har-sanitizer.
  • Cross-tenant impersonation (2023) - misconfigured delegated auth / unverified email change.

What to look for first in an Okta engagement

  1. Was MFA actually enforced for all admins + privileged apps? Pull current policies and policy change history.
  2. API tokens that exist today - created by whom, when, scope. Rotate any unknown.
  3. Any admin role grants in last 90d - compare to known admin roster.
  4. Any new auth policies, new network zones (whitelisting attacker IPs), new identity providers (SAML federation to attacker IdP).
  5. Factor resets by help-desk accounts - SIM swap / vishing indicator.
  6. Session impersonations by anyone, especially from support@okta.com-ish actor.
  7. New apps / modified apps with excessive scopes.