Okta

To sync Okta users and groups with the Anomali Agentic SOC Operations for identity management, you must configure the Okta integration on the Integrations Marketplace page. For details on identity management within the Anomali Agentic SOC Operations, see Identities.

Before You Begin

To configure the Okta integration, you must create one of the following:

• Okta API token. See How to Create an API Token for details.

• OAuth 2.0. client credentials. See Implement OAuth for Okta for details on how to create an OAuth 2.0 app in Okta and obtain its Client ID and Client Secret.
  When creating an OAuth 2.0. app, define the following API Scopes:
  

API Scope	Purpose
okta.users.read	List users
okta.groups.read	List groups and group members
okta.logs.read	Read system logs (sign-in activity and authentication events)

Configuring the Okta Integration

To configure the Okta integration:

1. Navigate to ThreatStream Next Gen > Integrations Marketplace > Entity Sources.

2. Click the three-dot vertical menu on the Okta tile and then click Configure.

   

   Alternatively, click the Okta tile and click Connect.

3. On the Configure Okta page that opens, enter the following details:

   Field Name	Description
   Name	Name of the integration.
   Description	(Optional) Description for the integration.
   Credentials
   Authentication Type	Authentication Types: API Token or Oauth 2.0 (Client Credentials). If API Token is selected, provide the following details: API Token: Enter your Okta API token. Okta Domain: Enter your Okta domain in the following format: <your_org_name>.okta.com If Oauth 2.O (Client Credentials) is selected, provide the following details: Client ID: Enter Client ID of the application created in Okta. Client Secret: Enter Client Secret of the application created in Okta. Okta Domain: Enter your Okta domain in the following format: <your_org_name>.okta.com
   Sync Configuration
   Batch Size	Number of identity records written per database operation. Default: 500. Note: Anomali recommends keeping the default batch size value unless you experience memory issues. Large values reduce database round trips but consume more memory.
   Full Sync Interval (days)	Interval in days after which a full sync is forced regardless of incremental sync state. Default: 1.
   Sign-in Activity Window (days)	Days of Okta system log events to fetch for sign-in activity enrichment. Default: 30
   Users Per Page	Number of users fetched per paginated API request. Default: 200.
   Field Mapping	Field mappings let you override which source attribute is used for each canonical identity field. This is useful when your directory uses non-standard attribute names or you want to prefer a specific field over the default.
   Display Name	Source attribute to use as the user's display name.
   Email/Hostname	Source attribute to use as the primary identity key.
   Department	Source attribute for department.
   Job Title	Source attribute for job title.
   Manager	Source attribute for the manager reference.
   Status	Source attribute that determines active/disabled state.
   Source ID	Source attribute to use as the stable internal identity ID.
   Sync Settings
   Sync Frequency	Interval for incremental syncs. Default: Hourly.

4. Click Create.

The Okta integration is activated. Confirm that the integration status shows Active and health shows Healthy.

On the integration details page, you can view the integration status, health, the date and time of the last synchronization with the source, the synchronization schedule, and the number of identities available in the configuration. On this page, you can also force sync, edit, deactivate, and delete the integration configuration. For details, see Managing Integrations.